docker-sssd-krb5-ldap

KO | EN

gitlite — search

#javascript #react #android #machine-learning #rust #linux #nodejs #java #windows #awesome-list #vue #pytorch #security #openai

docker-sssd-krb5-ldap

(★ 16)

A Docker image that provides the SSSD serivice with Active Directory configuration

docker-sssd-krb5-ldap Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Docker Image with SSSD,KRB5 and LDAP

[![Automated Build](https://img.shields.io/docker/automated/phihos/sssd-krb5-ldap.svg)](https://hub.docker.com/r/phihos/sssd-krb5-ldap/)
[![Docker Build Status](https://img.shields.io/docker/build/phihos/sssd-krb5-ldap.svg)](https://hub.docker.com/r/phihos/sssd-krb5-ldap/)

A Docker image that provides the SSSD service with Active Directory configuration.

## Introduction

This image provides a way to let PAM authenticate against active directory inside you Docker containers.
The configuration is done in a way that you do not need the AD administrator's password to use it. AD_LDAP credentials are sufficient.

## Running

```
docker run --name sssd \
    -e KERBEROS_REALM=YOURDOMAIN.TLD
    -e LDAP_BASE_DN="DC=YOURDOMAIN,DC=TLD" \
    -e LDAP_BIND_DN="CN=SOMEACCOUNT,DC=YOURDOMAIN,DC=TLD" \
    -e LDAP_BIND_PASSWORD=SOMEPASSWORD \
    -e LDAP_URI=ldap://YOUR-AD-LDAP-SERVER/ \
    -v /var/lib/sss
```

The volume is important because it can be mounted with ```--volume-from``` into other containers. These containers just need to have the SSSD client installed and can use the SSSD server remotely.

Optional parameters are:

| Option                        | Default           | Description                                                                                                                          |
|-------------------------------|-------------------|--------------------------------------------------------------------------------------------------------------------------------------|
| LDAP_USER_PRINCIPAL           | userPricipalName  | The LDAP attribute identifying the user name for Kerberos. Set this to a nonexisting entry if this differs from the actiol username. |
| KERBEROS_DNS_DISCOVERY_DOMAIN | ${KERBEROS_REALM} | Change this, if your DNS uses another domain suffic than your AD realm.                                                              |
| LDAP_ENUMERATE                | false             | If set to true all users and groups will be downloaded at startup. May cause bad performance.                                                    |
| LDAP_IGNORE_GROUP_MEMBERS     | true              | If set to false ```getent group <groupname>``` will contain all group members. May cause bad performance.                                 |

## Troubleshooting

If something goes wrong run the container with

```
docker run --name sssd ... sssd sssd -d 0x0270 -f
```

In a second console go into the container and try
```
getent USERNAME
```
Substitute *USERNAME* with a username that certainly exists. If nothing is displayed, the user lookup over the LDAP connection does not work. Look into */var/log/sssd* for further hints.

Secondly you can run
```
login USERNAME
```
and enter the correct password. If it says "login incorrect", then the AD part is somehow misconfigured. Again look into */var/log/sssd* for further hints.

## Contributing

This image offers just enough options that it fits my usecase. If you would like to exend the list of options feel free to make a PR.

docker-sssd-krb5-ldap

docker-sssd-krb5-ldap Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

docker-sssd-krb5-ldap

docker-sssd-krb5-ldap Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README