[Bug 778513] New: SSSD vs NSS/PAM + LDAP/KRB configuration mess in YaST

newer
[Bug 776975] New: Gnome displays:...

older
[Bug 793311] New: gvim does not...

bugzilla_noreply＠novell.com

3 Sep 2012 3 Sep '12

14:08

https://bugzilla.novell.com/show_bug.cgi?id=778513 https://bugzilla.novell.com/show_bug.cgi?id=778513#c0 Summary: SSSD vs NSS/PAM + LDAP/KRB configuration mess in YaST Classification: openSUSE Product: openSUSE 12.2 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: joschibrauchle@gmx.de QAContact: jsrain@suse.com Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.81 Safari/537.1 Hello, I would like to report/complain about some problems when switching from NSS/LDAP to SSSD together with LDAP/KRB. We are using LDAP as id provider along with Kerberos as auth provider. Previously under OpenSUSE 11.4, Yast provided "Network Services" + "LDAP Client"/"Kerberos client" for this configuration. Now we are trying to switch our existing configuration to SSSD under OpenSUSE 12.2, but noticed the following problems: ==================================== Problem 1) ==================================== In order to use SSSD with Kerberos, one needs to activate "Network Services" > "LDAP Client" > "Advanced Configuration" > "Use Kerberos". But then there exists "Network Services" > "Kerberos Client", where one needs to activate "Do Not Use Kerberos"! This is extremely confusing (configuring Kerberos in the LDAP client module, while having a second, inactive Kerberos module)! ==================================== Problem 2) ==================================== When using SSSD with Kerberos, there is no way in YaST to configure the following options: - krb5_ccachedir (string) - krb5_ccname_template (string) - krb5_auth_timeout (integer) - krb5_validate (boolean) - krb5_keytab (string) - krb5_renewable_lifetime (string) - krb5_lifetime (string) - krb5_renew_interval (integer) See http://linux.die.net/man/5/sssd-krb5 for details. Most of these options were previously configurable for NSS/PAM under "Network Services" > "Kerberos Client" > "Advanced Configuration", so I think this is a real regression of the new Yast LDAP/SSSD module. ==================================== Problem 3) ==================================== Switching back from SSSD to NSS/LDAP is not possible in Yast. When activating "Use Kerberos" under "Network Services" > "Kerberos Client", a message box pops up, saying: ------- System Security Services Daemon (SSSD) is configured. It is in use for Kerberos authentication instead of pam_krb5. You can disable SSSD in yast2 ldap-client module. ------- Unfortunately, in "LDAP client", there is NO option to turn off SSSD! In the Help of the "LDAP client" module, it says: ------- Check Use System Security Services Daemon if you want the system to use SSSD instead of nss_ldap. ------- but this option is nowhere to be found (it used to exist in OS11.4), hence it cannot be unchecked! It looks like the whole LDAP/KRB configuration procedure for SSSD needs to be redesigned. Currently, it is lacking configuration options that used to exist for NSS/PAM and it is very confusing to use! Also, there is no way to revert back to NSS/PAM, as the required checkbox is missing. Also, the LDAP/KRB config files /etc/ldap.conf, /etc/openldap/ldap.conf and /etc/krb5.conf are still used by many other applications! Hence, I suggest to have keep the legacy "LDAP+KRB" modules for these old but still required config files, along with a newly designed and completely separate "SSSD client" module! Reproducible: Always Steps to Reproduce: 1. 2. 3. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Show replies by date

bugzilla_noreply＠novell.com

4 Sep 4 Sep

12:57

New subject: [Bug 778513] SSSD vs NSS/PAM + LDAP/KRB configuration mess in YaST

https://bugzilla.novell.com/show_bug.cgi?id=778513 https://bugzilla.novell.com/show_bug.cgi?id=778513#c1 Joschi Brauchle changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|Normal |Critical --- Comment #1 from Joschi Brauchle 2012-09-04 12:57:25 UTC --- See openFATE discussion: https://features.opensuse.org/308902 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

12:57

New subject: [Bug 778513] SSSD vs NSS/PAM + LDAP/KRB configuration mess in YaST

https://bugzilla.novell.com/show_bug.cgi?id=778513 https://bugzilla.novell.com/show_bug.cgi?id=778513#c Joschi Brauchle changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|Critical |Normal -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

14:05

New subject: [Bug 778513] SSSD vs NSS/PAM + LDAP/KRB configuration mess in YaST

https://bugzilla.novell.com/show_bug.cgi?id=778513 https://bugzilla.novell.com/show_bug.cgi?id=778513#c2 --- Comment #2 from Joschi Brauchle 2012-09-04 14:05:59 UTC --- It looks like nss/pam configuration via Yast was removed (according to https://features.opensuse.org/313142) and refactoring of the "LDAP client" module is already in progress (https://features.opensuse.org/313143). Great! Hence, for 12.2 the irritating message about turning off SSSD in the "Kerberos Client" should be removed as well as the part about the missing SSSD checkbox in "LDAP Client" help (Problem 3). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

10 Sep 10 Sep

12:46

New subject: [Bug 778513] SSSD vs NSS/PAM + LDAP/KRB configuration mess in YaST

https://bugzilla.novell.com/show_bug.cgi?id=778513 https://bugzilla.novell.com/show_bug.cgi?id=778513#c kk zhang changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kkzhang@suse.com AssignedTo|bnc-team-screening@forge.pr |yast2-maintainers@suse.de |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

15:18

New subject: [Bug 778513] SSSD vs NSS/PAM + LDAP/KRB configuration mess in YaST

https://bugzilla.novell.com/show_bug.cgi?id=778513 https://bugzilla.novell.com/show_bug.cgi?id=778513#c Arvin Schnell changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|yast2-maintainers@suse.de |jsuchome@suse.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

12 Sep 12 Sep

12:16

New subject: [Bug 778513] SSSD vs NSS/PAM + LDAP/KRB configuration mess in YaST

https://bugzilla.novell.com/show_bug.cgi?id=778513 https://bugzilla.novell.com/show_bug.cgi?id=778513#c3 Jiří Suchomel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |rhafer@suse.com --- Comment #3 from Jiří Suchomel 2012-09-12 12:16:29 UTC --- Problem 3 is actually bug 775167. For Problem 2... I'm not sure where (and if) we should provide way to configure these options. Ralf, what do you think? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

15:46

New subject: [Bug 778513] SSSD vs NSS/PAM + LDAP/KRB configuration mess in YaST

https://bugzilla.novell.com/show_bug.cgi?id=778513 https://bugzilla.novell.com/show_bug.cgi?id=778513#c4 --- Comment #4 from Joschi Brauchle 2012-09-12 15:46:01 UTC --- The Kerberos Client used to have dialogs for these options, see (I hope the ASCII art comes out right :-) ------------ Advanced Kerberos Client Configuration ┌PAM Settings──Expert PAM Settings──PAM Services───────────┐ │ ┌Ticket Attributes─────────────────────────────────┐ │ │ │ 14d▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ │ │ │ │ Default Renewable Lifetime │ │ │ │ 28d▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ │ │ │ │ Forwardable Proxiable │ │ │ │ All services▒▒▒▒▒▒▒▒▒▒↓ No services▒▒▒▒▒▒▒▒▒▒▒▒↓ │ │ │ └──────────────────────────────────────────────────┘ │ │ [ ] Kerberos Support for OpenSSH Client │ │ [x] Ignore Unknown Users │ │ Minimum UID │ │ v 1^ │ │ Clock Skew [NTP Configuration...] │ │ 300▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ │ │ │ ... ------------ Advanced Kerberos Client Configuration ┌PAM Settings──Expert PAM Settings──PAM Services───────────┐ │ Keytab File Location [Browse...] │ │ ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ │ │ Credential Cache Directory [Browse...] │ │ ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ │ │ Credential Cache Template │ │ ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ │ │ Mappings │ │ ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ │ │ Banner │ │ ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ │ ... ------------ Maybe these dialogs can be reused/recreated for the corresponding SSSD options. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

20:16

New subject: [Bug 778513] SSSD vs NSS/PAM + LDAP/KRB configuration mess in YaST

https://bugzilla.novell.com/show_bug.cgi?id=778513 https://bugzilla.novell.com/show_bug.cgi?id=778513#c5 --- Comment #5 from Jiří Suchomel 2012-09-12 20:16:23 UTC --- Well, 'used to have'... it still has them. But those are relevant to krb5.conf file, which still can be used. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

13 Sep 13 Sep

07:10

New subject: [Bug 778513] SSSD vs NSS/PAM + LDAP/KRB configuration mess in YaST

https://bugzilla.novell.com/show_bug.cgi?id=778513 https://bugzilla.novell.com/show_bug.cgi?id=778513#c6 --- Comment #6 from Joschi Brauchle 2012-09-13 07:10:12 UTC --- Yes of course that's correct, they still exist and do work for krb5.conf (via Kerberos Client, enable Kerberos, adjust settings, disable Kerberos :-) I meant to duplicate them (maybe in some compacted/redesigned form, not all krb5.conf settings are available for SSSD) as an "Advanced Settings" button once the user enables Kerberos for SSSD. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

20 Sep 20 Sep

08:35

New subject: [Bug 778513] SSSD vs NSS/PAM + LDAP/KRB configuration mess in YaST

https://bugzilla.novell.com/show_bug.cgi?id=778513 https://bugzilla.novell.com/show_bug.cgi?id=778513#c7 --- Comment #7 from Jiří Suchomel 2012-09-20 08:35:30 UTC --- Hm, maybe we could right the UI which is currently there (in Kerberos client) and save the settings into sssd config instead of kerb5.conf, when we know sssd is used? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

25 Sep 25 Sep

15:10

New subject: [Bug 778513] SSSD vs NSS/PAM + LDAP/KRB configuration mess in YaST

https://bugzilla.novell.com/show_bug.cgi?id=778513 https://bugzilla.novell.com/show_bug.cgi?id=778513#c8 Ralf Haferkamp changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW CC| |rhafer@suse.com InfoProvider|rhafer@suse.com | --- Comment #8 from Ralf Haferkamp 2012-09-25 17:10:05 CEST --- (In reply to comment #7) Not sure what you mean by "... we could right the UI which is currently there ..." But I guess my answer is yes :) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.