<div dir="ltr">Update to this one: <div>It has been running smoothly on 6.5<br><div><div><br></div><div><div>[root@dev-zlei.sec1 ~]# cat /etc/redhat-release</div><div>CentOS release 6.5 (Final)</div></div><div><br></div><div>[root@dev-zlei.sec1 ~]# rpm -qa | grep sssd</div><div>sssd-client-1.12.4-47.el6.x86_64</div><div>sssd-ldap-1.12.4-47.el6.x86_64</div><div>sssd-ad-1.12.4-47.el6.x86_64</div><div>python-sssdconfig-1.12.4-47.el6.noarch</div><div>sssd-common-1.12.4-47.el6.x86_64</div><div>sssd-proxy-1.12.4-47.el6.x86_64</div><div>sssd-common-pac-1.12.4-47.el6.x86_64</div><div>sssd-krb5-1.12.4-47.el6.x86_64</div><div>sssd-ipa-1.12.4-47.el6.x86_64</div><div>sssd-krb5-common-1.12.4-47.el6.x86_64</div><div>sssd-1.12.4-47.el6.x86_64</div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jul 13, 2016 at 9:56 AM, Tomas Simecek <span dir="ltr"><<a href="mailto:simecek.tomas@gmail.com" target="_blank">simecek.tomas@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Thanks,<br></div><div>I will try. But I am afraid to update to more recent version then those in official repos.<br></div><div><br></div><div>Thanks anyway.<span class="HOEnZb"><font color="#888888"><br><br></font></span></div><span class="HOEnZb"><font color="#888888"><div>T.<br></div></font></span></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">2016-07-13 15:39 GMT+02:00 <span dir="ltr"><<a href="mailto:ladner.danila@gmail.com" target="_blank">ladner.danila@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div>Update to at least 1.12 sssd and libsss_sudo. As I recall sudo ipa provider did not work under 1.11<br><br>Sent from my iPhone</div><div><div><div><br>On Jul 13, 2016, at 9:02 AM, Tomas Simecek <<a href="mailto:simecek.tomas@gmail.com" target="_blank">simecek.tomas@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div><div>Hi,<br></div>versions are:<br>sssd-client-1.11.6-30.el6.x86_64<br>sssd-ipa-1.11.6-30.el6.x86_64<br>ipa-client-3.0.0-50.el6.centos.1.x86_64<br></div>as part of:<br>CentOS release 6.6 (Final)<br><div><br></div><div>T.<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-07-13 14:52 GMT+02:00 <span dir="ltr"><<a href="mailto:ladner.danila@gmail.com" target="_blank">ladner.danila@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div>Again what is client version on 6.5?</div><div><br><br>Sent from my iPhone</div><div><div><div><br>On Jul 13, 2016, at 8:25 AM, Tomas Simecek <<a href="mailto:simecek.tomas@gmail.com" target="_blank">simecek.tomas@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div><div>Thanks for your information Lukas,<br></div>I have changed sudo_provider to ipa, restarted sssd and no difference.<br></div><div>Logfile still says "Access granted by HBAC rule..." and sudo says <a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a> is not allowed to run sudo on zp-cml-test.<br><br></div><div>Btw. man sssd-sudo says: <br>The following example shows how to configure SSSD to download<br>sudo rules from an LDAP server.<br><br> [sssd]<br> config_file_version = 2<br> services = nss, pam, sudo<br> domains = EXAMPLE<br><br> [domain/EXAMPLE]<br> id_provider = ldap<br><br></div><div>so I am not that sure what should be set on my version of sssd.<br><br></div><div>Any idea?<br><br></div><div>Thanks<br><br></div><div>T.</div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-07-13 13:44 GMT+02:00 Lukas Slebodnik <span dir="ltr"><<a href="mailto:lslebodn@redhat.com" target="_blank">lslebodn@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On (13/07/16 13:36), Tomas Simecek wrote:<br> >Lukas,<br> >yes, I went through that guide and I configured sssd.conf as per the doc<br> >(you can see it in the beginning of the thread).<br> ><br> >Actually the installation is:<br> >[root@zp-cml-test sssd]# cat /etc/redhat-release<br> >CentOS release 6.6 (Final)<br> ><br> >and versions are:<br> >[root@zp-cml-test sssd]# rpm -qa |grep sssd<br> >sssd-proxy-1.11.6-30.el6.x86_64<br> >sssd-common-pac-1.11.6-30.el6.x86_64<br> >sssd-ipa-1.11.6-30.el6.x86_64<br> >sssd-1.11.6-30.el6.x86_64<br> >sssd-common-1.11.6-30.el6.x86_64<br> >sssd-ad-1.11.6-30.el6.x86_64<br> >sssd-ldap-1.11.6-30.el6.x86_64<br> >python-sssdconfig-1.11.6-30.el6.noarch<br> >sssd-krb5-common-1.11.6-30.el6.x86_64<br> >sssd-krb5-1.11.6-30.el6.x86_64<br> >sssd-client-1.11.6-30.el6.x86_64<br> ><br> </span>1.11 has sudo_provider=ipa<br> <br> @see instructions in man sssd-sudo how to configure it.<br> It should avoid issues with two different providers (ipa and ldap)<br> <span><br> ><br> >There are some reasons why not to upgrade to later versions, believe me, I<br> >would do it if I could :-)<br> ><br> </span>You can at least try to upgrade sssd from 6.8 if you do not want<br> to upgrade whole OS.<br> <span><font color="#888888"><br> LS<br> </font></span></blockquote></div><br></div> </div></blockquote></div></div><span><blockquote type="cite"><div><span>-- </span><br><span>Manage your subscription for the Freeipa-users mailing list:</span><br><span><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a></span><br><span>Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project</span></div></blockquote></span></div></blockquote></div><br></div> </div></blockquote></div></div></div></blockquote></div><br></div> </div></div></blockquote></div><br></div>