<div dir="ltr">Hi,<div><br></div><div>I try to access Cisco switch via ssh. Cisco has tacacs login configured.</div><div><br></div><div><div># tail /var/log/secure</div><div>May 11 14:18:46 freeipa tac_plus[29096]: pam_sss(tac_plus:auth): authentication success; logname=bartosz uid=0 euid=0 tty= ruser= rhost= user=bartosz</div><div>May 11 14:18:53 freeipa tac_plus[29096]: pam_sss(tac_plus:auth): authentication success; logname=bartosz uid=0 euid=0 tty= ruser= rhost= user=test</div></div><div><br></div><div>User bartosz is added in HBAC rule as Specified Users and Groups.</div><div>User test exist in FreeIPA but isn't in HBAC rule and shouldn't be autheniticated.</div><div class="gmail_extra"><br></div><div class="gmail_extra"><div class="gmail_extra"># cat /etc/sssd/sssd.conf </div><div class="gmail_extra">[domain/<a href="http://test.example.com">test.example.com</a>]</div><div class="gmail_extra">debug_level = 6</div><div class="gmail_extra">cache_credentials = True</div><div class="gmail_extra">krb5_store_password_if_offline = True</div><div class="gmail_extra">ipa_domain = <a href="http://test.example.com">test.example.com</a></div><div class="gmail_extra">id_provider = ipa</div><div class="gmail_extra">auth_provider = ipa</div><div class="gmail_extra">access_provider = ipa</div><div class="gmail_extra">ipa_hostname = <a href="http://freeipa.test.example.com">freeipa.test.example.com</a></div><div class="gmail_extra">chpass_provider = ipa</div><div class="gmail_extra">ipa_server = <a href="http://freeipa.test.example.com">freeipa.test.example.com</a></div><div class="gmail_extra">ipa_server_mode = True</div><div class="gmail_extra">ldap_tls_cacert = /etc/ipa/ca.crt</div><div class="gmail_extra"><br></div><div class="gmail_extra">[sssd]</div><div class="gmail_extra">services = nss, sudo, pam, ssh</div><div class="gmail_extra">config_file_version = 2</div><div class="gmail_extra">domains = <a href="http://test.example.com">test.example.com</a></div><div class="gmail_extra"><br></div><div class="gmail_extra">[nss]</div><div class="gmail_extra">homedir_substring = /home</div><div class="gmail_extra"><br></div><div class="gmail_extra">[pam]</div><div class="gmail_extra">debug_level = 6</div><div class="gmail_extra">domains = <a href="http://test.example.com">test.example.com</a></div><div class="gmail_extra"><br></div><div class="gmail_extra">[sudo]</div><div class="gmail_extra"><br></div><div class="gmail_extra">[autofs]</div><div class="gmail_extra"><br></div><div class="gmail_extra">[ssh]</div><div class="gmail_extra"><br></div><div class="gmail_extra">[pac]</div><div class="gmail_extra"><br></div><div class="gmail_extra">[ifp]</div><div><br></div></div><div class="gmail_extra"><br></div><div class="gmail_extra">#cat /var/log/sssd/sssd_pam.log</div><div class="gmail_extra"><div class="gmail_extra"><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [accept_fd_handler] (0x0400): Client connected to privileged pipe!</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [sss_cmd_get_version] (0x0200): Received client version [3].</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [sss_cmd_get_version] (0x0200): Offered version [3].</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_cmd_authenticate] (0x0100): entering pam_cmd_authenticate</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name 'test' matched without domain, user is test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): domain: not set</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): user: test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): service: tac_plus</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): tty: not set</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): rhost: not set</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): priv: 1</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 29218</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): logon name: test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [sss_dp_issue_request] (0x0400): Issuing request for [<a href="mailto:0x7f4f20215ed0%3A3%3Atest@test.example.com">0x7f4f20215ed0:3:test@test.example.com</a>]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [sss_dp_get_account_msg] (0x0400): Creating request for [<a href="http://test.example.com">test.example.com</a>][3][1][name=test]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [sss_dp_internal_get_send] (0x0400): Entering request [<a href="mailto:0x7f4f20215ed0%3A3%3Atest@test.example.com">0x7f4f20215ed0:3:test@test.example.com</a>]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_check_user_search] (0x0100): Requesting info for [<a href="mailto:test@test.example.com">test@test.example.com</a>]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_check_user_search] (0x0400): Returning info for user [<a href="mailto:test@test.example.com">test@test.example.com</a>]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending request with the following data:</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): domain: <a href="http://test.example.com">test.example.com</a></div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): user: test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): service: tac_plus</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): tty: not set</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): rhost: not set</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): priv: 1</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 29218</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_print_data] (0x0100): logon name: test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [sss_dp_req_destructor] (0x0400): Deleting request: [<a href="mailto:0x7f4f20215ed0%3A3%3Atest@test.example.com">0x7f4f20215ed0:3:test@test.example.com</a>]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_dp_process_reply] (0x0100): received: [0][<a href="http://test.example.com">test.example.com</a>]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [0].</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [0].</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [pam_reply] (0x0200): blen: 81</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[pam]] [client_recv] (0x0200): Client disconnected!</div></div></div><div class="gmail_extra"><br></div><div class="gmail_extra"># cat /var/log/sssd/sssd_test.example.com.log</div><div class="gmail_extra"><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [be_get_account_info] (0x0200): Got request for [0x3][1][name=test]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [be_req_set_domain] (0x0400): Changing request domain from [<a href="http://test.example.com">test.example.com</a>] to [<a href="http://test.example.com">test.example.com</a>]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [cn=accounts,dc=test,dc=example,dc=com]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=test)(objectclass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))][cn=accounts,dc=test,dc=example,dc=com].</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_save_user] (0x0400): Save user</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_primary_name] (0x0400): Processing object test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_save_user] (0x0400): Processing user test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_save_user] (0x0400): Adding original memberOf attributes to [test].</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_save_user] (0x0400): Adding user principal [<a href="mailto:test@TEST.EXAMPLE.COM">test@TEST.EXAMPLE.COM</a>] to attributes of [test].</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_save_user] (0x0400): Storing info for user test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_primary_name] (0x0400): Processing object test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_has_deref_support] (0x0400): The server supports deref method OpenLDAP</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*))][cn=ipausers,cn=groups,cn=accounts,dc=test,dc=example,dc=com].</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_primary_name] (0x0400): Processing object ipausers</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_groups_next_base] (0x0400): Searching for groups with base [cn=accounts,dc=test,dc=example,dc=com]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(gidNumber=732000003)(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*)(&(gidNumber=*)(!(gidNumber=0))))][cn=accounts,dc=test,dc=example,dc=com].</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_groups_process] (0x0400): Search for groups, returned 1 results.</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_has_deref_support] (0x0400): The server supports deref method OpenLDAP</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_nested_group_recv] (0x0400): 0 users found in the hash table</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_nested_group_recv] (0x0400): 1 groups found in the hash table</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_primary_name] (0x0400): Processing object test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_save_group] (0x0400): Processing group test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_process_ghost_members] (0x0400): The group has 0 members</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_process_ghost_members] (0x0400): Group has 0 members</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_save_group] (0x0400): Storing info for group test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_primary_name] (0x0400): Processing object test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_save_grpmem] (0x0400): Processing group test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_save_grpmem] (0x0400): Failed to get group sid</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_save_grpmem] (0x0400): No members for group [test]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:IPA:test.example.com:b8e22526-f4c0-11e4-8865-005056a8f368))][cn=Default Trust View,cn=views,cn=accounts,dc=test,dc=example,dc=com].</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [sdap_get_generic_op_finished] (0x0400): Search result: No such object(32), no errmsg set</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [be_req_set_domain] (0x0400): Changing request domain from [<a href="http://test.example.com">test.example.com</a>] to [<a href="http://test.example.com">test.example.com</a>]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [be_pam_handler] (0x0100): Got request with the following data</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [pam_print_data] (0x0100): domain: <a href="http://test.example.com">test.example.com</a></div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [pam_print_data] (0x0100): user: test</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [pam_print_data] (0x0100): service: tac_plus</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [pam_print_data] (0x0100): tty: </div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [pam_print_data] (0x0100): ruser: </div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [pam_print_data] (0x0100): rhost: </div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [pam_print_data] (0x0100): authtok type: 1</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [pam_print_data] (0x0100): newauthtok type: 0</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [pam_print_data] (0x0100): priv: 1</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [pam_print_data] (0x0100): cli_pid: 29218</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [pam_print_data] (0x0100): logon name: not set</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA'</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [be_resolve_server_process] (0x0200): Found address for server <a href="http://freeipa.test.example.com">freeipa.test.example.com</a>: [172.21.0.20] TTL 7200</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [write_pipe_handler] (0x0400): All data has been sent!</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [child_sig_handler] (0x0100): child [29226] finished successfully.</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [read_pipe_handler] (0x0400): EOF received, client finished</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [fo_set_port_status] (0x0100): Marking port 0 of server '<a href="http://freeipa.test.example.com">freeipa.test.example.com</a>' as 'working'</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [set_server_common_status] (0x0100): Marking server '<a href="http://freeipa.test.example.com">freeipa.test.example.com</a>' as 'working'</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [fo_set_port_status] (0x0400): Marking port 0 of duplicate server '<a href="http://freeipa.test.example.com">freeipa.test.example.com</a>' as 'working'</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 0, <NULL>) [Success]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [be_pam_handler_callback] (0x0100): Sending result [0][<a href="http://test.example.com">test.example.com</a>]</div><div class="gmail_extra">(Mon May 11 14:40:28 2015) [sssd[be[<a href="http://test.example.com">test.example.com</a>]]] [be_pam_handler_callback] (0x0100): Sent result [0][<a href="http://test.example.com">test.example.com</a>]</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-05-11 14:05 GMT+02:00 Jan Pazdziora <span dir="ltr"><<a href="mailto:jpazdziora@redhat.com" target="_blank">jpazdziora@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span>On Mon, May 11, 2015 at 01:57:38PM +0200, Jakub Hrozek wrote:<br>
> On Mon, May 11, 2015 at 01:19:01PM +0200, Vangass wrote:<br>
> > Hello,<br>
> ><br>
> > I have a problem with HBAC rules with conjunction with PAM authentication.<br>
> > What I try to do is to authenticate users: tac_plus - PAM (pam_sssd) -<br>
> > FreeIPA.<br>
> > It works just fine but without checking HBAC rules.<br>
> > What I did:<br>
> > - disabled allow_all rule<br>
> > - created new rule with one user and one service (tac_plus)<br>
> > And then, if I try to authenticate another user which is not in above rule<br>
> > then authetication is accepted and this user gets logged in.<br>
> > In logs, what I didn't find is an information about checking HBAC rules...<br>
> > Of course, when I use HBAC Test then everything is correct - one user is<br>
> > granted and another is declined.<br>
> ><br>
> > # cat /etc/pam.d/tac_plus<br>
> > auth required pam_sss.so<br>
> > account required pam_sss.so<br>
><br>
> If hbactest passes, then we need to see the logs, /var/log/secure and<br>
> SSSD logs. Also the sssd.conf, please.<br>
<br>
</span>Also, how did you configure that tac_plus PAM service should be used?<br>
How do you try to access the machine / service?<br>
<span><font color="#888888"><br>
--<br>
Jan Pazdziora<br>
Senior Principal Software Engineer, Identity Management Engineering, Red Hat<br>
</font></span><div><div><br>
--<br>
Manage your subscription for the Freeipa-users mailing list:<br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project<br>
</div></div></blockquote></div><br></div></div>