Client Authentication:Fedora via sssd/ldap

From SME Server
Jump to: navigation, search
Warning.png Warning:
This is based upon limited testing and a small number of users.


This how-to shows how to configure a SME-server (>=8b6) and a client Fedora (tested with F22 for this how-to) for a LDAP based SSSD authentication of the client machine on the configured user accounts of the SME. This way is more simple that the way via winbind Client Authentication:Fedora. Further more, the winbind method doesn't seem to work on a Fedora 22.

The SSSD authentication via LDAP allows to login with the SME-user accounts, even if the client machine is offline. Nevertheless, I recommend to create a local user with the admin rights for the emergency case.

These lines are a translation and an application of the method given by Daniel: Many thanks to him for it.

In this how-to: we assume that:

the host name of the SME is "sme-server" and the domain is "domain.tld".

Configuration of the SME-server

There is quite no necessary configuration of the SME.

  • The only thing to do is to create a user (named "auth" in this how-to) via the server-manager and to give him a valid password ("something_very_secret" in the how-to).

It is not required to make "auth" member of any group.

  • In addition, it is recommended to install and configure PHPki in order to make the managing of the certificates easier and to allow Fedora to accept a non-official certificate of the authentication.

Configuration of the client Fedora


Install the OS as usual, without any particularity.

Add the necessary packages

dnf install oddjob-mkhomedir sssd policycoreutils-python

Prepare the /home folder

The “/home” folders of the users will be placed at the same place as on the SME (/home/e-smith/fies/users). This must be configured to avoid blocks from SELinux:

mkdir -p /home/e-smith/files/users/
semanage fcontext -a -e /home /home/e-smith/files/users
restorecon -R /home/e-smith/files/users
restorecon -R /var/lib/sss

Active and enable the oddjobd daemon

This daemon will create the personal /home folders at the first login of the users.

systemctl start oddjobd.service
systemctl enable oddjobd.service

Manage the CA of the SME

after having installed phpki, go to https://www.domain.tld/phpki and download on the client machine the certificate of authority (ca.crt).

Place a copy of it or of another CA into /etc/phpki/tls/certs/ and give the 644 permissions:

cp ~/download/ca.crt /etc/phpki/tls/certs/
chmod 644 /etc/phpki/tls/certs/ca.crt

Place another copy of the ca into /etc/pki/ca-trust/source/anchors/ and install the certificate system wide:

cp ~/download/ca.crt /etc/pki/ca-trust/source/anchors/

(Note: to remove the ca systemwide: remove ca.crt from /etc/pki/ca-trust/source/anchors/ and run update-ca-trust again. See

Configure SSSD

The configuration is made by the file /ets/sssd/sssd.conf. This file doesn't exist by default. Therefore it has to be created and it needs to get the permissions 600 to allow the daemon to start:

cat <<'_EOF' > /etc/sssd/sssd.conf
config_file_version = 2
services = nss, pam
domains = LDAP



id_provider = ldap
auth_provider = ldap
ldap_schema = rfc2307
ldap_uri = ldap://sme-server.domain.tld
ldap_default_bind_dn = uid=auth,ou=Users,dc=domain,dc=tld
ldap_default_authtok = something_very_secret
ldap_default_authtok_type = password
ldap_search_base = dc=domain,dc=tld
ldap_user_search_base = ou=Users,dc=domain,dc=tld
ldap_group_search_base = ou=Groups,dc=domain,dc=tld
ldap_user_object_class = inetOrgPerson
ldap_user_gecos = cn
ldap_tls_reqcert = hard
ldap_tls_cacert = /etc/pki/tls/certs/ca.crt
ldap_id_use_start_tls = true
# uncomment below if the SME is a “iPasserelle”
#ldap_user_shell = desktopLoginShell
# comment below if the SME is a “iPasserelle”
override_shell = /bin/bash
cache_credentials = true
enumerate = true
# It is possible to filter the logins via a LDAP-filer
# by commenting the both lines below.
# In this exemple, only the users member of the group netusers
# will be valid on this host.
# posixMemberOF is a parameter only for a iPasserelle
#access_provider = ldap
#ldap_access_filter = (|(posixMemberOf=admins)(uid=backup))

chmod 600 /etc/sssd/sssd.conf

Information.png Tip:
Make sure that the file /etc/pki/tls/certs/ca.crt contains the CA that has sign the certificate of the SME (if PHPki is used, a version > 0,82-13 is required).

Start and enable the daemon sssd

  • This daemon must be automatically started by running the client machine:
systemctl start sssd.service
systemctl enable sssd.service

Information.png Tip:
It is possible to debug by starting sssd manually:
systemctl stop sssd.service
sssd -i -d5

  • You should check that sss is set as a source in the /etc/nsswitch.conf. Normally it has been done automatically
passwd:     files sss
shadow:     files sss
group:      files sss

General configuration

  • The system must be configured in order to use sssd.

This is done very easily by using the tool authconfig:

authconfig --enablemkhomedir --enablesssd --enablesssdauth --update
getent passwd 

should show you the users of the SME.

If it doesn't work:

  • check first of all if the password of the user “auth” is present in clear by the parameter “ldap_default_authtok” of /etc/sssd/sssd.conf.
  • Further more, for tests and debug, you can set “ldap_tls_reqcert = never” to avoid problems due to a non accepted CA.
Warning.png Warning:
It is not recommended to use this parameter for a production server!

Information.png Tip:
It is possible to give admin permissions to LDAP-users: on Fedora, members of the special, local "wheel" group will be admin, so just add your LDAP users to this group:

gpasswd -a <your ldap login> wheel

Automount of the ibays and of the user folders

  • Make sure that both rpms pam_mount and cifs-utils are installed
sudo dnf install  pam_mount, cifs-utils
  • Modify /etc/pam.d/lightdm (can be /etc/pam.d/gdm-password by Gnome instead of XFCE) as follow:
auth [success=done ignore=ignore default=bad]
auth required
auth substack system-auth
-auth optional
-auth optional
auth optional
auth include postlogin

account required
account include system-auth

password include system-auth

session required close
session required
session optional
-session optional
session required open
session optional force revoke
session required
-session optional auto_start
-session optional
session include system-auth
session optional silent
session optional
session include postlogin 

by adding:

session optional
session include postlogin

at the end of the file.

  • Edit the /etc/security/pam_mount.conf.xml file. Find the 'Volume Definitions' section and add after it:
<volume fstype="cifs" server="" path="ibay1" mountpoint="/media/sme/ibay1" user="*" options="rw,auto,iocharset=utf8" />
<volume fstype="cifs" server="" path="ibay2" mountpoint="/media/sme/ibay2" user="*" options="rw,auto,iocharset=utf8" />
<volume fstype="cifs" server="" path="%(USER)" mountpoint="/media/sme/%(USER)/" user="*" options="rw,auto,iocharset=utf8" />
  • Create all the above configured the mount points:
sudo mkdir /media/sme/ibay1
sudo chmod 777 /media/sme/ibay1
sudo mkdir /media/sme/ibay2
sudo chmod 777 /media/sme/ibay2

sudo mkdir /media/sme/user1
sudo chmod 777 /media/sme/user1
sudo mkdir /media/sme/user2
sudo chmod 777 /media/sme/user2

Important.png Note:
With Fedora21, it was possible only the create and chmod777 /media/sme. The different mount points (ibay1, ibay2 etc...) have been created automatically by Fedora at the mounting operation. // It seem that this is not possible any more!!

Please inform us, if there is a way to get it again.

Information.png Tip:
Event if all the mount points are created, the several shares (ibays and user folders) are only mounted according to the permissions of the user.

Information.png Tip:
The shares are automatically unmounted when the user loggs out.

That's all. Enjoy!