On pe, 18 touko 2018, Marc Boorshtein wrote:
>>
>> I'm working with the ipa web services to provision users across a one
>> way trust with IPA. I have looked at the id_view_* services and am
>> trying to wrap my head around a few details:
>>
>> 1. When I ssh into a linux box thats a member of the IPA domain with
>> my AD user IPA creates an object in LDAP and assigns a gid and uid to
>> it, but when i create the user in the ID View under the Default Trust
>> View the information from the object isn't there, BUT when I set the
>> shell it gets written to the directory object when I update the shell
>> attribute. Shouldn't the user's gid/uid be visible there as part of
>> the view?
>
> IPA does not create any specific object in LDAP when you are ssh-ing
> into a Linux box. That simply does not happen and never was.
>
> Can you demonstrate what you are talking about with a concrete example
> using 'ipa idoverrideuser-*' commands?
>
IPA Domain - rhelent.lan
AD Domain -
ent2k12.domain.com
One way trust with rhelent.lan trusting
ent2k12.domain.com
1. Create a user in AD - thor(a)ent2k12.domain.com
2. Search IPA's 389 for (uid=thor(a)ent2k12.domain.com), no results
3. Login to server in rhelent.lan
4. sudo su - thor(a)ent2k12.domain.com
5. id - uid=160812321(thor(a)ent2k12.domain.com)
gid=160812321(thor(a)ent2k12.domain.com)
groups=160812321(thor(a)ent2k12.domain.com),160800513(domain
users(a)ent2k12.domain.com)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
6. Search IPA's 389 for (uid=thor(a)ent2k12.domain.com), found at
uid=thor(a)ent2k12.domain.com,cn=users,cn=compat,dc=rhelent,dc=lan, no
shell attribute
7. login to the ipa web interface - Create a user override for
uid=thor(a)ent2k12.domain.com and a shell of /bin/bash
8. Search IPA's 389 for (uid=thor(a)ent2k12.domain.com), found at
uid=thor(a)ent2k12.domain.com,cn=users,cn=compat,dc=rhelent,dc=lan, no
shell attribute
9. sudo su - thor(a)ent2k12.domain.com - now my default shell is bash
I thought i would see a shell attribute after #8 but thats not the
case. Where is the override stored?
What you see above is a compat entry, not an ID
override. Compat entry
is provided on demand -- in fact, you searched it and it was created by
looking up in SSSD. This information in compat tree is not used normally
by any client using SSSD with 'id_provider=ipa' at all. It is for
clients that don't use SSSD or use SSSD old enough that it doesn't
support trust to AD directly.
>> 2. When I add a user from AD to an external group should I
specify
>> the userPrincipalName as the external member?
>
> You should specify something that SSSD will be able to resolve to an AD
> user. It could be username@domain or NetBIOS\username or anything else
> that SSSD could resolve.
>
OK, that makes sense
>> 3. Is there a way to get IPA to trigger the creation of the ldap
>> object that represents the AD user via a web service instead of
>> logging in or sudoing over to that user?
>
> No. And both sudoing or logging in into the host does not create the
> LDAP object as well. You as administrator should create those entries.
>
This doesn't seem to linueup with the steps produced above, what am I missing?
You are looking at wrong objects in a wrong place and make wrong
conclusions based on that. ;)
See Windows Integration Guide, "Chapter 8. Using ID Views in Active Directory
Environments"
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
for details on ID overrides.
See Windows Integration Guide, section "5.6. Active Directory Trust for Legacy
Linux Clients" for details about the compat tree.
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
You can also read
https://pagure.io/slapi-nis/blob/master/f/doc/ipa/sch-ipa.txt but compat
tree is not something you should be looking at if your IPA clients are
using SSSD newer than 1.9.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland