Is there a option in SSSD or the plugin to turn off the normalization ?

On Tue, May 30, 2017 at 2:27 PM, Alexander Bokovoy <abokovoy@redhat.com> wrote:
On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote:
So I took a brand new user that I have never used in the system before (I
checked that the entry was not in the compat tree) and just ran an "id"
command on Solaris system.  I then looked in the /var/log/dirsrv/slapd-<ipa
domain>/access log file on the ipa server, for the query and from the log
file, the query came in as all caps.

example:
[~]$: id 831413@WIN.MYDOMIN.COM

[~]$: cat /var/log/dirsrv/slapd-<ipa domain>/access |grep 831413
[30/May/2017:13:34:38.637498942 -0400] conn=94124 op=622 SRCH
base="cn=users,cn=compat,dc=ipa,dc=mydomain,dc=com" scope=1
filter="(&(objectClass=posixAccount)(uid=831413@WIN.MYDOMIN.COM))"
attrs="cn uid uidNumber gidNumber gecos description homeDirectory
loginShell"
[30/May/2017:13:34:38.651811322 -0400] conn=94124 op=622 RESULT err=0
tag=101 nentries=1 etime=0

However, the entry in the compat tree is all lowercase just like I
reported.  I can reproduce this easily.
memberUid value comes from SSSD look up. SSSD normalizes all names to
low case.

For group names, I'm not sure they are normalized, though.




Robert Johnson

On Tue, May 30, 2017 at 1:10 PM, Alexander Bokovoy <abokovoy@redhat.com>
wrote:

On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote:

Red Hat Enterprise Linux Server release 7.3
ipa-server-4.4.0-14.el7_3.4.x86_64
389-ds-base-1.3.5.10-15.el7_3.x86_64
sssd-1.14.0-43.el7_3.11.x86_64

When looking at entries in the "cn=groups,cn=compat" tree, I noticed that
the entries for windows groups have the realm portion of the group name in
all caps.  This is true for the comment, the dn and the cn.
example:
# domain users@WIN.MYDOMAIN.COM, groups, compat, ipa.mydomain.com
dn: cn=domain users@WIN.MYDOMAIN.COM
,cn=groups,cn=compat,dc=ipa,dc=mydomain,dc=com
memberUid: 123456@win.mydomain.com
cn: domain users@WIN.MYDOMAIN.COM

When I look at the entries in the "cn=users,cn=compat" tree, the realm
portion of the user name is all lower case.  Incidentally, these same user
names are also all lowercase in the "memberUid" option on the groups
above.
example:
# 123456@win.mydomain.com, users, compat, ipa.mydomain.com
dn: uid=123456@win.mydomain.com,cn=users,cn=compat,dc=ipa,dc=myd
omain,dc=com
homeDirectory: /home/win.mydomain.com/123456
uid: 123456@win.mydomain.com

Was this by design ?

Users and groups for AD users are inserted into the compat tree on
demand, when a request comes mentioning them via LDAP query. The name is
taken from the LDAP query.

So it is your application(s) that are asking fully qualified user/group
names with domain part capitalized.


The reason I ask, is that when I try to use the "kinit" feature on our
Solaris 10 systems (which is joined to the IPA domain) for this windows
user, I get an error.

[~]$ kinit
Password for 123456@win.mydomain.com:
kinit(v5): KDC reply did not match expectations while getting initial
credentials

If I run it like this:
[~]$ kinit 123456@WIN.MYDOMAIN.COM
Password for 123456@WIN.MYDOMAIN.COM:
[~]$ klist
Ticket cache: FILE:/tmp/krb5cc_1683378846
Default principal: 123456@WIN.MYDOMAIN.COM

Valid starting                Expires                Service principal
05/30/17 11:44:35  05/30/17 21:44:40  krbtgt/
WIN.MYDOMAIN.COM@WIN.MYDOMAIN.COM
       renew until 06/06/17 11:44:35

I believe this is due to the fact that the Solaris 10 system is using the
lowercase entry in the compat tree above.  Here is the result of the ID
command on this user:
[~]$ id
uid=1683378846(123456@win.mydomain.com) gid=1683378846(
123456@WIN.MYDOMAIN.COM)

I know this is a work around but I would prefer to make this easier on the
end users.  Any suggestions ?

You mix up Kerberos principals and user identities. They are different.
In Kerberos protocol realm is case-sensitive. WIN.MYDOMAIN.COM is not
the same realm as win.mydomain.com. On Active Directory side this is
hidden behind the Windows UI facade but on UNIX systems Kerberos
libraries aren't hiding this fact.

That's why you get "KDC reply did not match expectations .." error
message -- a realm name is used as part of Kerberos exchange and it is
expected to be all upper cases.

On identity front you have probably configured your Solaris systems to
look up identities with upper cased fqdn and compat tree plugin inserts
those as it is. I certainly don't see this behavior with other systems.

--
/ Alexander Bokovoy


_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org


--
/ Alexander Bokovoy