<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 04/20/2015 12:08 PM, Srdjan Dutina
wrote:<br>
</div>
<blockquote
cite="mid:CAGTepmC9T-92zVyCXOrMg0+0Zyd3WBnSx2HegT9rBaWvYY5+qA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>Sorry for misunderstanding. <br>
<br>
</div>
<div>I understand HBAC rules will not work for Centos 5. I
just wanted to make sure disabling "allow all" rule and
adding new HBAC rules won't interfere with AD users logging
on Centos 5.<br>
</div>
</div>
</div>
</blockquote>
<br>
To clarify:<br>
CentOS 5 needs to point to compat tree for AD users to authenticate.<br>
You need to use LDAP SSSD back end for that not IPA SSSD back end
(idenity_provider setting in sssd.conf).<br>
Once you use LDAP back end you need to use some other access control
configuration not HBAC as HBAC comes when you use IPA SSSD back end
only.<br>
You can use ldap filter or simple acces provider or something other
option that is support in SSSD 1.5 against LDAP.<br>
<br>
Does this make sense?<br>
<br>
<br>
<blockquote
cite="mid:CAGTepmC9T-92zVyCXOrMg0+0Zyd3WBnSx2HegT9rBaWvYY5+qA@mail.gmail.com"
type="cite"><br>
<div class="gmail_quote">On Mon, Apr 20, 2015 at 5:03 PM Alexander
Bokovoy <<a moz-do-not-send="true"
href="mailto:abokovoy@redhat.com">abokovoy@redhat.com</a>>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">On Mon, 20
Apr 2015, Srdjan Dutina wrote:<br>
>Just found in<br>
><a moz-do-not-send="true"
href="http://www.freeipa.org/images/0/0d/FreeIPA33-legacy-clients.pdf"
target="_blank">http://www.freeipa.org/images/0/0d/FreeIPA33-legacy-clients.pdf</a>
the next<br>
>sentence: "If you have HBAC's allow_all rule disabled, you
will need to<br>
>allow system-auth service on the FreeIPA master, so that
authentication of<br>
>the AD users can be performed."<br>
>Is this true for FreeIPA 4.1.0 also and how could I do
this?<br>
Either you are reading it wrong or I don't get where you want
to apply<br>
HBAC rules because this is for IPA masters, not legacy clients
per se.<br>
Yes, you nede to create HBAC service named 'system-auth' and
grant<br>
access to it to AD users on IPA masters, but all it will allow
you is to<br>
authenticate AD users via compat tree.<br>
<br>
If your RHEL5 SSSD clients attempt to run own HBAC rule
checks, AD users<br>
cannot be checked by those rules.<br>
<br>
<br>
<br>
--<br>
/ Alexander Bokovoy<br>
</blockquote>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>