<div dir="ltr">When I use <span style="font-size:12.8000001907349px">id_provider=ipa I get: </span><br><br><span style="font-size:12.8000001907349px">[sssd[be[default]]] [main] (0x0010): Could not initialize backend [2]</span><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px">Adding a [ssh] section with just "debug_level = 10"on it, I get:</span><br><br><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [get_client_cred] (0x4000): Client creds: euid[1742200001] egid[1742200001] pid[6295].</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0xd34eb0][17]</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [accept_fd_handler] (0x0400): Client connected!</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0xd34eb0][17]</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sss_cmd_get_version] (0x0200): Received client version [0].</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sss_cmd_get_version] (0x0200): Offered version [0].</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0xd34eb0][17]</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0xd34eb0][17]</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [ssh_cmd_parse_request] (0x0400): Requested domain [<ALL>]</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [ssh_cmd_parse_request] (0x0400): Parsing name [admin][<ALL>]</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sss_parse_name] (0x0100): Domain not provided!</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sss_parse_name_for_domains] (0x0200): name 'admin' matched without domain, user is admin</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sss_ssh_cmd_get_user_pubkeys] (0x0400): Requesting SSH user public keys for [admin] from [<ALL>]</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sss_dp_issue_request] (0x0400): Issuing request for [0x40aba0:1:admin@default]</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sss_dp_get_account_msg] (0x0400): Creating request for [default][1][1][name=admin]</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sbus_add_timeout] (0x2000): 0xd32ba0</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sss_dp_internal_get_send] (0x0400): Entering request [0x40aba0:1:admin@default]</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sbus_remove_timeout] (0x2000): 0xd32ba0</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sbus_dispatch] (0x4000): dbus conn: 0xd310f0</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sbus_dispatch] (0x4000): Dispatching.</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 0 errno: 0 error message: Success</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [ssh_user_pubkeys_search_next] (0x0400): Requesting SSH user public keys for [admin@default]</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sss_parse_name] (0x0100): Domain not provided!</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [ldb] (0x4000): Added timed event "ltdb_callback": 0xd3f3b0</span></div><div style=""><span style="font-size:12.8000001907349px"><br></span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0xd3f470</span></div><div style=""><span style="font-size:12.8000001907349px"><br></span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [ldb] (0x4000): Running timer event 0xd3f3b0 "ltdb_callback"</span></div><div style=""><span style="font-size:12.8000001907349px"><br></span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [ldb] (0x4000): Destroying timer event 0xd3f470 "ltdb_timeout"</span></div><div style=""><span style="font-size:12.8000001907349px"><br></span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [ldb] (0x4000): Ending timer event 0xd3f3b0 "ltdb_callback"</span></div><div style=""><span style="font-size:12.8000001907349px"><br></span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x40aba0:1:admin@default]</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0xd34eb0][17]</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0xd34eb0][17]</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [client_recv] (0x0200): Client disconnected!</span></div><div style=""><span style="font-size:12.8000001907349px">(Thu Sep 17 17:27:12 2015) [sssd[ssh]] [client_destructor] (0x2000): Terminated client [0xd34eb0][17]</span></div></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px">ldbsearch shows this (</span><span style="font-size:12.8000001907349px">ldbsearch -H /var/lib/sss/db/cache_default.ldb name=admin)</span><span style="font-size:12.8000001907349px">: </span></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><div style=""><br></div><div style=""><span style="font-size:12.8000001907349px">asq: Unable to register control with rootdse!</span></div><div style=""><span style="font-size:12.8000001907349px"># record 1</span></div><div style=""><span style="font-size:12.8000001907349px">dn: name=admin,cn=users,cn=default,cn=sysdb</span></div><div style=""><span style="font-size:12.8000001907349px">createTimestamp: 1442509579</span></div><div style=""><span style="font-size:12.8000001907349px">fullName: Administrator</span></div><div style=""><span style="font-size:12.8000001907349px">gecos: Administrator</span></div><div style=""><span style="font-size:12.8000001907349px">gidNumber: 1742200000</span></div><div style=""><span style="font-size:12.8000001907349px">homeDirectory: /home/admin</span></div><div style=""><span style="font-size:12.8000001907349px">loginShell: /bin/bash</span></div><div style=""><span style="font-size:12.8000001907349px">name: admin</span></div><div style=""><span style="font-size:12.8000001907349px">objectClass: user</span></div><div style=""><span style="font-size:12.8000001907349px">uidNumber: 1742200000</span></div><div style=""><span style="font-size:12.8000001907349px">originalDN: uid=admin,cn=users,cn=compat,dc=my,dc=domain,dc=com</span></div><div style=""><span style="font-size:12.8000001907349px">originalModifyTimestamp: 20150829000451Z</span></div><div style=""><span style="font-size:12.8000001907349px">entryUSN: 1428</span></div><div style=""><span style="font-size:12.8000001907349px">lastUpdate: 1442509579</span></div><div style=""><span style="font-size:12.8000001907349px">dataExpireTimestamp: 1442514979</span></div><div style=""><span style="font-size:12.8000001907349px">distinguishedName: name=admin,cn=users,cn=default,cn=sysdb</span></div><div style=""><span style="font-size:12.8000001907349px"><br></span></div><div style=""><span style="font-size:12.8000001907349px"># returned 1 records</span></div><div style=""><span style="font-size:12.8000001907349px"># 1 entries</span></div><div style=""><span style="font-size:12.8000001907349px"># 0 referrals</span></div></div><div style=""><span style="font-size:12.8000001907349px"><br></span></div><div style=""><span style="font-size:12.8000001907349px"><br></span></div><div style=""><span style="font-size:12.8000001907349px"><br></span></div><div style=""><span style="font-size:12.8000001907349px"><br></span></div><div style="">Thanks,<br>Gustavo</div><div style=""><span style="font-size:12.8000001907349px"><br></span></div><div style=""><span style="font-size:12.8000001907349px"><br></span></div><div style=""><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px"><br></span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Sep 17, 2015 at 12:25 AM, Jakub Hrozek <span dir="ltr"><<a href="mailto:jhrozek@redhat.com" target="_blank">jhrozek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On Wed, Sep 16, 2015 at 11:28:49AM -0700, Gustavo Mateus wrote:<br> > Hi,<br> ><br> > I have an IPA server running on redhat and I'm trying find the best way to<br> > get my amazon linux instances to use it for authentication, ssh key<br> > management and sudo rules.<br> ><br> > I'm now trying to use SSSD to achieve those goals. Authentication is<br> > working but I'm having problems to get the user public ssh keys using<br> > /usr/bin/sss_ssh_authorizedkeys.<br> ><br> ><br> > This is my sssd.conf:<br> ><br> > [sssd]<br> > services = nss, pam, ssh, sudo<br> > config_file_version = 2<br> > domains = default<br> > re_expression = (?P<name>.+)<br> ><br> > [domain/default]<br> > debug_level = 8<br> > cache_credentials = True<br> > id_provider = ldap<br> > auth_provider = ldap<br> > ldap_uri = ldap://<a href="http://ipa.my.domain.com" rel="noreferrer" target="_blank">ipa.my.domain.com</a><br> > ldap_search_base = cn=compat,dc=my,dc=domain,dc=com<br> > ldap_tls_cacert = /etc/openldap/cacerts/ipa.crt<br> > ldap_user_ssh_public_key = ipaSshPubKey<br> ><br> ><br> > The original configuration was done using ipa-advise ipa-advise<br> > config-redhat-sssd-before-1-9.<br> <br> </div></div>Is there any particular reason do keep doing this versus joining the<br> client to the domain and using id_provider=ipa ?<br> <span class=""><br> > I just hanged the services parameter to<br> > include "ssh, sudo" and "ldap_user_ssh_public_key"<br> <br> </span>I don't think sudo would work unless you authenticate the LDAP<br> connection.<br> <span class=""><br> ><br> > When I run it on the client I get no response or error. Even running it in<br> > debug mode:<br> ><br> > /usr/bin/sss_ssh_authorizedkeys admin --debug 10<br> <br> </span>I would check if:<br> - debug_level in the [ssh] section reveals anything. Is the ssh<br> responder being contacted, are there any errors?<br> - check with ldbsearch (ldb-tools package) if there ssh key<br> attribute is really fetched from IPA LDAP and is stored along the<br> user entry<br> <span class="HOEnZb"><font color="#888888"><br> --<br> Manage your subscription for the Freeipa-users mailing list:<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> </font></span></blockquote></div><br></div>