On ke, 04 heinä 2018, Pieter Baele via FreeIPA-users wrote:
Hi,
On a test FreeIPA environment (4.5.0-22), a user is shown using the id
command, so ID Override is working as well.
id xxxx(a)accmsnet.railb.be
uid=8028(xxx(a)Accmsnet.railb.be) gid=4030(ucc)
groups=4030(ucc),702800513(domain users(a)Accmsnet.railb.be
),1318400009(ad_users)
However this particular (AD) user is not shown using an ldapsearch in the
compat
ldapsearch -Y GSSAPI -b cn=compat,dc=accnix,dc=infrabel,dc=be
'(&(objectClass=posixAccount)(uid=xxxx))'
# extended LDIF
#
# LDAPv3
# base <cn=compat,dc=accnix,dc=infrabel,dc=be> with scope subtree
# filter: (&(objectClass=posixAccount)(uid=mcj7700))
Here uid is non-fully
qualified. A trigger in the compat tree plugin is
built around using fully qualified user names for AD users, e.g.
(uid=mcj770(a)accmsnet.railb.be).
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland