[CentOS] ldap host attribute is ignored

Tue May 12 21:04:29 UTC 2015
m.roth at 5-cent.us <m.roth at 5-cent.us>

Ulrich Hiller wrote:
> i thought this too.
> I think this:
> access_provider = ldap
> ldap_access_filter = memberOf=host=does-not-exist-host
> ldap_access_order = filter
> ldap_user_authorized_host = host
> must confuse sssd so much that it denies login. But the user without
> host attribute can still login.
Wait - are you saying that it didn't deny, but now it does? If that's the
case, then you're almost there, just that the condition is backwards (like
sshd_config, with PermitRootLogin Without-Password means that you have to
use a key, not that it permits root to come in without a password....