It would be nice to see logs from the non-working case, see https://fedorahosted.org/sssd/wiki/Troubleshooting and https://fedorahosted.org/sssd/wiki/Reporting_sssd_bugs

Can you log in (via su or similar) as user@mariadb ? Using the FQDN would route the request to the mariadb domain directly.

Logfile for domain mariadb
sssd_mariadb.log

Logfile for domain ssh
sssd_ssh.log

Replying to [comment:1 jhrozek]:

It would be nice to see logs from the non-working case, see https://fedorahosted.org/sssd/wiki/Troubleshooting and https://fedorahosted.org/sssd/wiki/Reporting_sssd_bugs

Can you log in (via su or similar) as user@mariadb ? Using the FQDN would route the request to the mariadb domain directly.

I think it is not possible to add a @domain in my case. I'm trying to authenticate using the mysql/mariadb command line client.

mysql -u user1 -p

The authentication works as long as no domain restriction is configured.
As you can see in the logs all auth requests are routed into the ssh domain (which should never be used)

The user (user1) is present inside the ssh domain.
(Please note that currently both domains are (currently) using the same ldap parameters)

I think there are (at least) two problems:
a) Using the wrong domain (which should not lead to auth problem so far because the user i'm using for my tests is present)
b) The domain restriction does not work as expected. ssh domain should never be used

1) it /should/ be possible to use something like mysql -u user1@ssh -p since the username is parsed inside sssd
2) Please attach sssd_pam.log, we need to see how the authentication requests are routed.

attachment
sssd_pam.log

I tried mysql -u user1@mariadb -p without success.

The pam logfile was empty due to a too low debug_level. Sorry.

Fields changed

owner: somebody => preichl

Hello,

on first glance on sssd_pam.log I can see

[sss_parse_name_for_domains] (0x0200): name 'user1' matched without domain, user is user1
...
[pam_check_user_search] (0x0100): Requesting info for [user1@ssh]

Which implies that user is assumed to be from ssh domain instead of mariadb which could be the root issue.

I wonder why it was not matched against mariadb if you looked it up using 'user1@mariadb'

It could be worth to add "use_fully_qualified_names = TRUE" to both domains to make sure that lookup is done for fqdn input only.

Please increase debug_level in pam section to 10.

Thanks.

Hello,

today I had some time to investigate further, my results:

A) Misconfiguration of mariadb:
I had a user 'user1' inside the mariadb user configuration, but the user 'user1@mariadb' was missing.
This is the reason why I was never able to succeed with mysql -u user1@mariadb -p

B) I added use_fully_qualified_names = TRUE to both domains (ssh and mariadb)

Result: 
  mysql -u user1 -p         => Failed
  mysql -u user1@mariadb -p => Success
Log: sssd_pam.log_both_fully_qualified (see Attachments)

C) I added use_fully_qualified_names = TRUE to ssh domain only

Result: 
  mysql -u user1 -p          => Success
  mysql -u user1@mariadb -p  => Success
Log: sssd_pam.log_ssh_qualified_only (see Attachments)

D) I added use_fully_qualified_names = TRUE to mariadb domain only

Result: 
  mysql -u user1 -p          => Failed
  mysql -u user1@mariadb -p  => Success
Log: sssd_pam.log_mariadb_qualified_only (see Attachments)

E) I removed use_fully_qualified_names = TRUE from both domains

Result: 
  mysql -u user1 -p          => Failed
  mysql -u user1@mariadb -p  => Failed
Log: sssd_pam.log_none_fully_qualified (see Attachments)

A full qualified mariadb-login is not what I want (Too many webapps to adjust). So I'm currently going with C)

When my understanding of the domains= parameter in the pam service (/etc/pam.d/mariadb) file is correct, the ssh domain should never be used for user lookup. Is this correct? What will happen when I try to add a third domain, lets say for openvpn access? The idea was to only allow one domain in each pam service file and to prevent fully qualified logins.

Each (currently) added logfile holds two login attempts:
1. user1
2. user1@mariadb

Please let me know when you need additional tries/logs.

Thanks for your help!

_comment0: Hello,

today I had some time to investigate further, my results:

A) Misconfiguration of mariadb:
I had a user 'user1' inside the mariadb user configuration, but the user 'user1@mariadb' was missing.
This is the reason why I was never able to succeed with mysql -u user1@mariadb -p

B) I added use_fully_qualified_names = TRUE to both domains (ssh and mariadb)
{{{
Result:
mysql -u user1 -p => Failed
mysql -u user1@mariadb -p => Success

Log: sssd_pam.log_both_fully_qualified (see Attachments)
}}}

C) I added use_fully_qualified_names = TRUE to ssh domain only
{{{
Result:
mysql -u user1 -p => Success
mysql -u user1@mariadb -p => Success

Log: sssd_pam.log_ssh_qualified_only (see Attachments)
}}}

D) I added use_fully_qualified_names = TRUE to mariadb domain only
{{{
Result:
mysql -u user1 -p => Failed
mysql -u user1@mariadb -p => Success

Log: sssd_pam.log_mariadb_qualified_only (see Attachments)
}}}

E) I removed use_fully_qualified_names = TRUE from both domains
{{{
Result:
mysql -u user1 -p => Failed
mysql -u user1@mariadb -p => Failed

Log: sssd_pam.log_none_fully_qualified (see Attachments)
}}}

A full qualified mariadb-login is not what I want (Too many webapps to adjust). So I'm currently going with C)

When my understanding of the domains= parameter in the pam service (/etc/pam.d/mariadb) file is correct, the ssh domain should never be used for user lookup. Is this correct?

Each (currently) added logfile holds two login attempts:
1. user1
2. user1@mariadb

Please let me know when you need additional tries/logs.

Thanks for your help! => 1452295391926469

attachment
sssd_pam.log_none_fully_qualified

attachment
sssd_pam.log_ssh_qualified_only

attachment
sssd_pam.log_mariadb_qualified_only

attachment
sssd_pam.log_both_fully_qualified

Flonix, the problem as I understand it now is that you use same ldap database for both [ssh] and [mariadb] domains. If you then lookup user without domain specification SSSD can't determine which domain you had in mind and may return the wrong one (as it was happening according to the original logs).

If you can't use fqdn names in your case and you will lookup user names that are in multiple domains you might end up with user from different domain then you expected.

However if you can use fqdn in mariadb login then you don't have to add option use_fully_qualified_names = TRUE to any domain (as correct domain will be determined from domain part of user name).

Replying to [comment:8 preichl]:

Flonix, the problem as I understand it now is that you use same ldap database for both [ssh] and [mariadb] domains. If you then lookup user without domain specification SSSD can't determine which domain you had in mind and may return the wrong one (as it was happening according to the original logs).

Shouldn't sssd use the first match?

But if the database is the same, then I don't understand the point of separating them for different PAM services. Flonix, what is it exactly you're trying to achieve, only allow some users to authenticate against a particular database? I think this would much better be achieved with access_provider configuration.

Replying to [comment:9 jhrozek]:

Replying to [comment:8 preichl]:

Flonix, the problem as I understand it now is that you use same ldap database for both [ssh] and [mariadb] domains. If you then lookup user without domain specification SSSD can't determine which domain you had in mind and may return the wrong one (as it was happening according to the original logs).

Shouldn't sssd use the first match?

I suppose so, but from domain definition or from values of 'domains' option from sssd section? Anyway I think it's not good idea to depend on this order.

But if the database is the same, then I don't understand the point of separating them for different PAM services. Flonix, what is it exactly you're trying to achieve, only allow some users to authenticate against a particular database? I think this would much better be achieved with access_provider configuration.

Flonix do you still have any trouble with this setup or can we close this as a problem of misconfigured mariadb?

Sorry for the delay,

we have one LDAP Server with different subtrees and different objectClasses for each service.
(We have to use different search filters for each service)

I know that sssd will take the first match it has found in its domains.
But: What is the job of the domains= parameter in pam service files, when it is not possible to restrict the domains sssd will use for this service/auth-request?

When each service file restricts the domains with domains=service_name, full qualified usernames should never be required. Right?

Our ldap tree looks like this:

    base
          service_sshd
               user1 -> maybe posixUser (ldap schema, objectClass)
               user2
          service_mariadb
               userA -> maybe something like mysqlUser
               user1 -> (will not happen for us, but possible as well)

Maybe there is a better solution using the mentioned access_provider.

Can you please provide an example?

Can you then set the service_sshd,base as the search base for the sshd domain and service_mariadb,base for the mariadb domain? You can use the ldap_search_base parameter for that. Ditto with the objectclasses. IMO that's a more robust solution than fiddling with PAM service files..

Replying to [comment:11 flonix]:

I know that sssd will take the first match it has found in its domains.
But: What is the job of the domains= parameter in pam service files, when it is not possible to restrict the domains sssd will use for this service/auth-request?

User is looked up independently on this PAM module option, as looking up and authorization services are independent.

So user is looked up against all domains, but authorization is performed against domains restricted by PAM module option domains.

You have to be sure that name collisions won't happen - either use fully qualified names or for example (as Jakub proposed) - by using ldap_search_base option.

My setup is now working as expected.
I did not change the configuration, but made some (unrelated) changes to the ldap schema.

I'am not sure, but maybe I was running into a caching problem as well.

This bug can be closed now. Thanks for your help!

_comment0: Thanks for your help.

My setup is now working as expected.
I did not change the configuration, but made some (unrelated) changes to the ldap schema.

I'am not sure, but maybe I was running into a caching problem as well.

This bug can be closed now. Thanks for your help! => 1453157067996808

Thank you for reporting back. Closing.

resolution: => worksforme
status: new => closed

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3952

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.