CentOS - Jun 2016 - sssd.conf file missing

Hello --

We are running CentOS 7.2 on a virtual machine, and we are trying to set up LDAP
authentication. The ldap packages that are currently installed on the system are
the following:

python-sss 1.13.0-40.el7_2.4
python-sssdconfig 1.13.0-40.el7_2.4
sssd 1.13.0-40.el7_2.4
sssd-ad 1.13.0-40.el7_2.4
sssd-client 1.13.0-40.el7_2.4
sssd-common 1.13.0-40.el7_2.4
sssd-common-pac 1.13.0-40.el7_2.4
sssd-dbus 1.13.0-40.el7_2.4
sssd-ipa 1.13.0-40.el7_2.4
sssd-krb5 1.13.0-40.el7_2.4
sssd-krb5-common 1.13.0-40.el7_2.4
sssd-ldap 1.13.0-40.el7_2.4
sssd-libwbclient 1.13.0-40.el7_2.4
sssd-libwbclient-devel 1.13.0-40.el7_2.4
sssd-proxy 1.13.0-40.el7_2.4
sssd-tools 1.13.0-40.el7_2.4

I ran the following commands to set up LDAP/AD authentication:

# ln -s /bin/bash /bin/PHSshell
# ln -s /home /PHShome
# authconfig --enablesssdauth --enablemkhomedir --enablesssd -update
# chkconfig sssd on
# service sssd restart

Initially, I ran into problems because I had not created an sssd.conf file.
Eventually I did create one, and its contents are the following:

[<domain>.org]
enumate = true
cache_credentials = TRUE

id_provider = ldap
auth_provider = ldap
chpass_provider = ldap

ldap_uri = ldap://ldap.<domain>.org
ldap_search_base = dc=<domain>,dc=org
tls_reqcert = demand
ldap_tls_cacert /etc/pki/tls/certs/ca-bundle.crt

If there are any additions or corrections that I need to make, please let me
know.

I reran the service sssd restart command, and the error message that I am seeing
via journalctl -xe is the following:

Unit sssd.service has begun starting up.
Jun 22 16:05:34 roadtest2.partners.org sssd[6384]: SSSD couldn't load the
configuration database [5]: Input/output error.
Jun 22 16:05:34 roadtest2.partners.org systemd[1]: sssd.service: control process
exited, code=exited status=4
Jun 22 16:05:34 roadtest2.partners.org systemd[1]: Failed to start System
Security Services Daemon.
-- Subject: Unit sssd.service has failed
-- Defined-By: systemd
-- Support:
http://lists.freedesktop.org/mailman.../systemd-devel<http://lists.freedesktop.org/mailman/listinfo/systemd-devel>
--
-- Unit sssd.service has failed.
--
-- The result is failed.
Jun 22 16:05:34 roadtest2.partners.org systemd[1]: Unit sssd.service entered
failed state.
Jun 22 16:05:34 roadtest2.partners.org systemd[1]: sssd.service failed.
Jun 22 16:05:34 roadtest2.partners.org polkitd[787]: Unregistered Authentication
Agent for unix-process:6369:52587318 (system bus name :1.2287,
object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
(disconnected from bus)

Any ideas?


The information in this e-mail is intended only for the person to whom it is
addressed. If you believe this e-mail was sent to you in error and the e-mail
contains patient information, please contact the Partners Compliance HelpLine at
http://www.partners.org/complianceline . If the e-mail was sent to you in error
but does not contain patient information, please contact the sender and properly
dispose of the e-mail.

On 06/23/2016 05:23 AM, Kaplan, Andrew H. wrote:
> We are running CentOS 7.2 on a virtual machine, and we are trying to set up
LDAP authentication.
In an AD environment, it's important to point out that you typically 
can't do "ldap authentication".  You can, but you'll need a
service
account to do it, and none of the work you've described so far indicates 
that you've set one up.

Instead of thinking about AD as LDAP, consider it a set of services that 
should be used together.  Technically, you'll use LDAP for identity and 
Kerberos for authentication, but you should think of AD as providing 
both identity and authentication.

The easy way to use AD is to use the realm tool to set up integration:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Windows_Integration_Guide/realmd-domain.html

The details of setting up AD manually are described in excruciating 
detail here:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/pdf/Windows_Integration_Guide/Red_Hat_Enterprise_Linux-7-Windows_Integration_Guide-en-US.pdf

If you use realmd, you should not need to edit sssd.conf at all.  If you 
decide to do things manually, I'd still recommend providing the complete 
configuration description to "authconfig" and allowing it to write 
sssd.conf for you.