<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> Jakub Hrozek wrote: <blockquote cite="mid20151207171225.GK5290@hendrix.arn.redhat.com" type="cite"> <pre wrap="">On Mon, Dec 07, 2015 at 06:04:30PM +0100, Stefano Cortese wrote: </pre> <blockquote type="cite"> <blockquote type="cite"> <blockquote type="cite"> <pre wrap="">So the questions are: - is there another cleaner way to exclude the localauth sssd plugin (considering that the configuration snippet is recreated at every sssd restart)? </pre> </blockquote> <pre wrap="">Can you test if this hack would help: # service sssd stop # rm /var/lib/sss/pubconf/krb5.include.d/localauth_plugin # touch /var/lib/sss/pubconf/krb5.include.d/localauth_plugin # chattr +i /var/lib/sss/pubconf/krb5.include.d/localauth_plugin # service sssd start </pre> </blockquote> <pre wrap="">It works, thanks </pre> <blockquote type="cite"> <pre wrap="">btw also check out this ticket: <a class="moz-txt-link-freetext" href="https://fedorahosted.org/sssd/ticket/2788">https://fedorahosted.org/sssd/ticket/2788</a> </pre> </blockquote> <pre wrap="">not needing principal switching from/to root for the moment </pre> </blockquote> <pre wrap=""> Yes, sorry, wrong ticket: <a class="moz-txt-link-freetext" href="https://fedorahosted.org/sssd/ticket/2707">https://fedorahosted.org/sssd/ticket/2707</a> </pre> </blockquote> <blockquote cite="mid20151207171225.GK5290@hendrix.arn.redhat.com" type="cite"> <pre wrap=""></pre> <blockquote type="cite"> <blockquote type="cite"> <pre wrap=""> </pre> </blockquote> <pre wrap="">Maybe I wasn't clear in describing the setup. I am attempting to log from a local machine as "userA" using the credentials of a "service principal" defined in IPA to a remote machine as "userB" The userB principal is resolvable on the remote host via "getent passwd userB" because it is a user principal. Also the userA principal is resolvable on the local machine, but this should not play a role because the user's credentials are not used for the connection, only the service credentials, as a client. The service principal is not resolvable via "getent passwd" neither on the originating host nor on the destination host. The trick with .k5login is that the service principal used in the connection is granted access as userB because it is listed as one of the principals that correspond to the userB posix account on the remote host. </pre> </blockquote> <pre wrap=""> Thank you, then I think #2707 would help you because you could configure that .k5login is still used. </pre> </blockquote> Hi Jakub, yes maybe it could help, even if I didn't find many details (bugzilla says I am not authorized to access the RedHat Bug 1240302 with my bugzilla account, I have tried also with our RedHat support licensed account) . It seems having been filed for sssd 1.14 and RHEL7 , is there any hope that it will be implemented also for 6.7 or 6.8 ? we can't upgrade to 7 for the IPA clients. Bye Stefano </body> </html>