authselect-migration - Man Page

This manual page explains the main differences between authconfig, the previous tool to configure system authentication and identity sources, and authselect which replaces it​. It also explains what actions need to be done in order to migrate from authconfig to authselect​.

Authselect takes a completely different approach to system configuration than the previous tool authconfig​.

Authconfig tries its best to keep user’s manual changes to the files it generates​. It generates not only PAM configuration files and nsswitch​.conf (to setup authentication modules and identity sources) but it also generates simple configuration files for several services such as LDAP and Kerberos​.

Authselect does no such things​. It does not generate any configuration files besides PAM and nsswitch​.conf and it strictly prohibits any manual changes to generated configuration​. It provides a set of files called profiles​. Each profile describes how the resulting configuration should look like and it can be slightly modified by enabling or disabling certain optional features​. If a need arises for a different profile than what authselect ships, the administrator has an option to create a whole new profile and use it with authselect​. See authselect-profiles(5) to learn more about profiles​.

This may seem like a big disadvantage but the truth is the opposite​. Authconfig is a very old tool and the applications providing required services have changed rapidly over the years​. Typically, there is no longer a need to have multiple authentication modules in PAM and nsswitch​.conf, because the vast majority of use-cases is covered by SSSD​. Therefore there is no need to add or remove them specifically​. There are also better tools to generate configuration for system daemons that can help you automate the process of joining to a remote domain such as realm​. In addition, the shipped profiles give us comprehensive and deterministic system configuration that can be fully tested and is much less error prone​. It is also much easier to distribute such configuration across many systems​.

Probably the most controversial change is that authselect only ships profiles for sssd and winbind providers​. Those two providers cover all modern use cases from providing local users and legacy LDAP domain to complex configurations with IPA or Active Directory servers​. The profiles no longer contain support for nss-pam-ldapd and users are encouraged to switch to sssd​.

You can use either ipa-client-install or realm to join an IPA domain and realm to join an Active Directory domain​. These tools will make sure that the correct authselect profile is selected and all daemons and services are properly configured​.

If you use ipa-client-install or realm to join a domain, you can just remove any authconfig call in your scripts​. If this is not an option, you need to replace each authconfig call with its equivalent authselect call to select a correct profile with desired features​. Then you also need to write configuration file for required services​.

Table ​1. ​Relation of authconfig options to authselect profiles

Table ​2. ​Relation of authconfig options to authselect profile features

Examples.

authconfig --enableldap --enableldapauth --enablefaillock --updateall
authselect select sssd with-faillock

authconfig --enablesssd --enablesssdauth --enablesmartcard --smartcardmodule=sssd --updateall
authselect select sssd with-smartcard

authconfig --enableecryptfs --enablepamaccess --updateall
authselect select sssd with-ecryptfs with-pamaccess

authconfig --enablewinbind --enablewinbindauth --winbindjoin=Administrator --updateall
realm join -U Administrator --client-software=winbind WINBINDDOMAIN

This section contains snippets for minimal configuration of various services​.

# Set the default base dn
BASE   dc=example,dc=com

# Set the default LDAP server
URI    ldap://ldap​.example​.com ldap://ldap-master​.example​.com:666

[libdefaults]
 default_realm = MYREALM

[realms]
 MYREALM = {
  kdc = kdc​.myrealm​.org
 }

[domain_realm]
 myrealm​.org = MYREALM
 ​.myrealm​.org = MYREALM

[sssd]
config_file_version = 2
domains = default

[domain/default]
id_provider = ldap
ldap_uri = _srv_
dns_discovery_domain = myrealm

[sssd]
config_file_version = 2
domains = default

[domain/default]
id_provider = ldap
auth_provider = krb5
ldap_uri = _srv_
krb5_server = _srv_
krb5_realm = MYREALM
dns_discovery_domain = myrealm

Depending on your configuration, you need to start required services manually with systemd​.

• SSSD

  systemctl enable sssd​.service ; systemctl start sssd​.service

• Winbind

  systemctl enable winbind​.service ; systemctl start winbind​.service

• If mkhomedir feature is enabled

  systemctl enable oddjobd​.service ; systemctl start oddjobd​.service

Authconfig shipped a tool called cacertdir_rehash​. If you depend on this tool, please switch to native openssl command: openssl rehash <directory> that serves the same purpose​.

authselect(8), authselect-profiles(5), realm(8), ipa-client-install(1), sssd​.conf(5), smb​.conf(5), ldap​.conf(5), krb5​.conf(5)

authselect(8).