SSSD で access_provider = ldap の設定に問題があります。問題は ldap_access_filter にあります。
LDAP 側は次のようになります: ユーザー:
# username, users, location, dc1.dc2
dn: uid=username,ou=users,l=location,dc=dc1,dc=dc2
shadowExpire: 17507
shadowLastChange: 17494
shadowMin: 0
shadowMax: 0
shadowInactive: 0
shadowFlag: 0
shadowWarning: 0
loginShell: /bin/bash
homeDirectory: /home/username
gidNumber: 2341
uidNumber: 6432
uid: username
mail: username@company.com
sn: Name
objectClass: organizationalPerson
objectClass: person
objectClass: posixAccount
objectClass: top
objectClass: inetOrgPerson
objectClass: shadowAccount
cn: User Name
title: User Title
mobile: xxxxxxxxx
manager: uid=usermanager,ou=users,l=location,dc=dc1,dc=dc2
グループ：
# allowed-group, groups, location, dc1.dc2
dn: cn=allowed-group,ou=groups,l=location,dc=dc1,dc=dc2
cn: allowed-group
objectClass: top
objectClass: groupOfUniqueNames
objectClass: posixGroup
gidNumber: 2140
description: Group description
uniqueMember: uid=username,ou=users,l=location,dc=dc1,dc=dc2
ldap_access_filter = uniqueMember=cn=allowed-group を設定しようとしましたが、常に次のメッセージでアクセスが拒否されます:
(Tue Dec 5 18:22:44 2017) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=username)(objectclass=posixAccount)(uniqueMember=cn=allowed-group,ou=groups,l=location,dc=dc1,dc=dc1))][uid=username,ou=users,l=location,dc=dc1,dc=dc2].
(Tue Dec 5 18:22:44 2017) [sssd[be[LDAP]]] [sdap_access_filter_done] (0x0100): User [username@ldap] was not found with the specified filter. Denying access.
sssd.conf
[sssd]
config_file_version = 2
services = nss, pam
domains = LDAP
[nss]
filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd,nagios
[pam]
[domain/LDAP]
id_provider = ldap
auth_provider = ldap
access_provider = ldap
ldap_uri = ldap://uri
ldap_schema = rfc2307bis
ldap_search_base = l=location,dc=dc1,dc=dc2
ldap_group_object_class = groupOfUniqueNames
ldap_group_member = uniqueMember
ldap_access_order = filter, expire
ldap_account_expire_policy = shadow
ldap_access_filter = uniqueMember=cn=allowed-group,ou=groups,l=location,dc=dc1,dc=dc1
cache_credentials = true
enumerate = true
debug_level = 8
ldap_tls_reqcert = demand
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_cacert = /etc/pki/tls/cacert.pem
そのldapスキーマの正しいldap_access_filterを作成する方法を指摘できる人はいますか?