Red Hat Enterprise Linux Server release 7.3
ipa-server-4.4.0-14.el7_3.4.x86_64
389-ds-base-1.3.5.10-15.el7_3.x86_64
sssd-1.14.0-43.el7_3.11.x86_64
When looking at entries in the "cn=groups,cn=compat" tree, I noticed that the entries for windows groups have the realm portion of the group name in all caps. This is true for the comment, the dn and the cn.
example:
# domain
users@WIN.MYDOMAIN.COM, groups, compat,
ipa.mydomain.comdn: cn=domain
users@WIN.MYDOMAIN.COM,cn=groups,cn=compat,dc=ipa,dc=mydomain,dc=com
memberUid:
123456@win.mydomain.comcn: domain
users@WIN.MYDOMAIN.COMWhen I look at the entries in the "cn=users,cn=compat" tree, the realm portion of the user name is all lower case. Incidentally, these same user names are also all lowercase in the "memberUid" option on the groups above.
example:
#
123456@win.mydomain.com, users, compat,
ipa.mydomain.comdn: uid=
123456@win.mydomain.com,cn=users,cn=compat,dc=ipa,dc=mydomain,dc=com
homeDirectory: /home/
win.mydomain.com/123456uid:
123456@win.mydomain.comWas this by design ?
The reason I ask, is that when I try to use the "kinit" feature on our Solaris 10 systems (which is joined to the IPA domain) for this windows user, I get an error.
[~]$ kinit
Password for
123456@win.mydomain.com:
kinit(v5): KDC reply did not match expectations while getting initial credentials
I believe this is due to the fact that the Solaris 10 system is using the lowercase entry in the compat tree above. Here is the result of the ID command on this user:
[~]$ id
uid=1683378846(
123456@win.mydomain.com) gid=1683378846(
123456@WIN.MYDOMAIN.COM)
I know this is a work around but I would prefer to make this easier on the end users. Any suggestions ?