☰

SSSD 不尊重嵌套 AD 組

tag-icon • tag-icon linux active-directory sssd
SSSD 不尊重嵌套 AD 組

我有一個加入網域的伺服器，配置了 sssd。在 sssd.conf 中我使用

ad_access_filter = (memberof=CN=CustomGroup,OU=Security Group,DC=company,DC=com)

這對於以下使用者來說效果很好，但對於屬於以下群組成員的CustomGroup使用者則不然Nested_CustomGroupCustomGroup

我的 sssd.conf 如下圖所示：

[sssd]
domains = company.com
config_file_version = 2
services = nss, pam

[domain/company.com]
ad_domain = company.com
krb5_realm = COMPANY.COM

cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
ignore_group_members = False
ldap_group_nesting_level = 2
use_fully_qualified_names = False
fallback_homedir = /home/%u
case_sensitive = false
access_provider = ad
auth_provider = ad
enumerate = false
ad_gpo_access_control = disabled
ad_access_filter = (memberof=CN=CustomGroup,OU=Security Group,DC=company,DC=com)

使用者從嵌套群組登入期間的 sshd 日誌日誌：

server sshd[30781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x user=someuser
server sshd[30781]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x user=someuser
server sshd[30781]: pam_sss(sshd:account): Access denied for user someuser: 6 (Permission denied)
server sshd[30781]: Failed password for someuser from x.x.x.x port 26241 ssh2
server sshd[30781]: fatal: Access denied for user someuser by PAM account configuration [preauth]

有任何想法嗎？謝謝你，

答案1

為了在 LDAP 語法中針對 Active Directory 查詢帳戶的遞歸或巢狀群組成員身份，您需要使用 OID 1.2.840.113556.1.4.1941，這是LDAP_MATCHING_RULE_IN_CHAIN或LDAP_MATCHING_RULE_TRANSITIVE_EVAL

在您的情況下，您需要調整訪問過濾器以

(memberOf:1.2.840.113556.1.4.1941:=CN=CustomGroup,OU=Security Group,DC=company,DC=com)

相關內容