<div dir="ltr">Okay, for the Internet at large, forget about that SSSD garbage. The following will get a fresh install of RHEL 6 (and I assume 7) authenticating against and Active Directory server (without caring about updating the AD password and such):<div>
<br></div><div>$ yum install pam_ldap</div><div>$ authconfig --enableldapauth --enablelocauthorize --update</div><div>$ openssl s_client -connect <a href="http://ldap.example.com:636">ldap.example.com:636</a> 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /etc/openldap/cacerts/ldap.example.com.crt # press "return" again to terminate process</div>
<div>$ cacertdir_rehash</div><div><br></div><div>Finally, configure /etc/pam_ldap.conf appropriately:</div><div><br></div><div>`````</div><div># Set to the base LDAP tree for the users you want to authorize</div><div><div>
base OU=Cool Guys,OU=Departments,dc=example,dc=com</div><div><br></div><div># URI of the LDAP server </div><div>uri ldaps://<a href="http://ldap.example.com/">ldap.example.com/</a></div><div># A user that can search the LDAP tree</div>
<div>binddn CN=Searcher,cn=Users,DC=example,DC=com</div><div># The search user's password</div><div>bindpw the_correct_directory_reader_password</div><div> </div><div>scope sub</div><div> </div><div>pam_filter objectClass=User</div>
<div>pam_login_attribute sAMAccountName</div><div>pam_password ad</div><div> </div><div># RFC 2307 (AD) mappings</div><div>nss_map_objectclass posixAccount user</div><div>nss_map_objectclass shadowAccount user</div><div>nss_map_attribute uid sAMAccountName</div>
<div>nss_map_attribute homeDirectory unixHomeDirectory</div><div>nss_map_attribute shadowLastChange pwdLastSet</div><div>nss_map_objectclass posixGroup group</div><div>nss_map_attribute uniquteMember member</div><div> </div>
<div>ssl on</div><div>sasl_secprops maxssf=0</div><div>referrals no</div></div><div>`````</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jun 13, 2014 at 9:21 AM, Jim Kinney <span dir="ltr"><<a href="mailto:jim.kinney@gmail.com" target="_blank">jim.kinney@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">You will need to check nsswitch file to have password by LDAP or sssd and home by files. Then every user add will require multiple steps. Add in AD then again on each machine.</p>
<div class="gmail_quote"><div><div class="h5">On Jun 13, 2014 9:10 AM, "James Sumners" <<a href="mailto:james.sumners@gmail.com" target="_blank">james.sumners@gmail.com</a>> wrote:<br type="attribution"></div>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
<div dir="ltr"><div class="gmail_extra">I'm sorry, I do not know what question you are answering. I never mentioned wanting password changes propagated to anything. In fact, these accounts are normally created with no valid password at all on the local machine. That's what I want: user attempts to login, system checks with AD to verify credentials, and then home dir shell etc is pulled from the the local user account.<br>
<br><div class="gmail_quote">On Sat, Jun 7, 2014 at 10:20 AM, Jim Kinney <span dir="ltr"><<a href="mailto:jim.kinney@gmail.com" target="_blank">jim.kinney@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<p dir="ltr">Hmm. As much as it pains me to say this, sssd can use AD as the master auth process. Unless AD admin provides an access id with write ability, password changes will have to occur on AD and then propagate to IPA.</p>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>James Sumners<br><a href="http://james.roomfullofmirrors.com/" target="_blank">http://james.roomfullofmirrors.com/</a><br><br>"All governments suffer a recurring problem: Power attracts pathological personalities. It is not that power corrupts but that it is magnetic to the corruptible. Such people have a tendency to become drunk on violence, a condition to which they are quickly addicted."<br>
<br>Missionaria Protectiva, Text QIV (decto)<br>CH:D 5</div></div>
<br></div></div><div class="">_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org" target="_blank">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></div></blockquote></div>
<br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>James Sumners<br><a href="http://james.roomfullofmirrors.com/">http://james.roomfullofmirrors.com/</a><br><br>"All governments suffer a recurring problem: Power attracts pathological personalities. It is not that power corrupts but that it is magnetic to the corruptible. Such people have a tendency to become drunk on violence, a condition to which they are quickly addicted."<br>
<br>Missionaria Protectiva, Text QIV (decto)<br>CH:D 59
</div>