SSSD - 基于LDAP组的访问 - ldap架构rfc2307bis

Posted 2021-04-21

我在SSSD中设置access_provider = ldap时遇到问题。问题在于ldap_access_filter。

LDAP端看起来像这样：USER：

# username, users, location, dc1.dc2
dn: uid=username,ou=users,l=location,dc=dc1,dc=dc2
shadowExpire: 17507
shadowLastChange: 17494
shadowMin: 0
shadowMax: 0
shadowInactive: 0
shadowFlag: 0
shadowWarning: 0
loginShell: /bin/bash
homeDirectory: /home/username
gidNumber: 2341
uidNumber: 6432
uid: username
mail: [e-mail]
sn: Name
objectClass: organizationalPerson
objectClass: person
objectClass: posixAccount
objectClass: top
objectClass: inetOrgPerson
objectClass: shadowAccount
cn: User Name
title: User Title
mobile: xxxxxxxxx
manager: uid=usermanager,ou=users,l=location,dc=dc1,dc=dc2

组：

# allowed-group, groups, location, dc1.dc2
dn: cn=allowed-group,ou=groups,l=location,dc=dc1,dc=dc2
cn: allowed-group
objectClass: top
objectClass: groupOfUniqueNames
objectClass: posixGroup
gidNumber: 2140
description: Group description
uniqueMember: uid=username,ou=users,l=location,dc=dc1,dc=dc2

我试图设置ldap_access_filter = uniqueMember = cn = allowed-group但它总是会拒绝访问以下消息：

(Tue Dec  5 18:22:44 2017) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=username)(objectclass=posixAccount)(uniqueMember=cn=allowed-group,ou=groups,l=location,dc=dc1,dc=dc1))][uid=username,ou=users,l=location,dc=dc1,dc=dc2].
(Tue Dec  5 18:22:44 2017) [sssd[be[LDAP]]] [sdap_access_filter_done] (0x0100): User [username@ldap] was not found with the specified filter. Denying access.

sssd.conf

[sssd]
config_file_version = 2
services = nss, pam
domains = LDAP
[nss]
filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd,nagios
[pam]
[domain/LDAP]
id_provider = ldap
auth_provider = ldap
access_provider = ldap
ldap_uri = ldap://uri
ldap_schema = rfc2307bis
ldap_search_base = l=location,dc=dc1,dc=dc2
ldap_group_object_class = groupOfUniqueNames
ldap_group_member = uniqueMember
ldap_access_order = filter, expire
ldap_account_expire_policy = shadow
ldap_access_filter = uniqueMember=cn=allowed-group,ou=groups,l=location,dc=dc1,dc=dc1
cache_credentials = true
enumerate = true
debug_level = 8
ldap_tls_reqcert = demand
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_cacert = /etc/pki/tls/cacert.pem

是否有人能够指出如何为该ldap架构创建正确的ldap_access_filter？

答案

您需要sssd查看用户的属性，而不是组的用户列表，例如

ldap_access_filter = memberOf=cn=allowed-group,ou=groups,l=location,dc=dc1,dc=dc1

要将memberOf属性添加到用户的记录中，您需要使用memberof overlay（假设您的LDAP服务器正在运行OpenLDAP）。

另一答案

或者，对于基于组的访问控制，您可以使用access_provider = simple，然后列出允许的组。