Re: [CentOS] ldap host attribute is ignored

Ulrich Hiller wrote:

i thought this too. I think this:

access_provider = ldap ldap_access_filter = memberOf=host=does-not-exist-host ldap_access_order = filter ldap_user_authorized_host = host

must confuse sssd so much that it denies login. But the user without host attribute can still login.

Wait - are you saying that it didn't deny, but now it does? If that's the case, then you're almost there, just that the condition is backwards (like sshd_config, with PermitRootLogin Without-Password means that you have to use a key, not that it permits root to come in without a password....

mark