On Wed, Jun 28, 2017 at 08:22:12PM +0200, Jakub Hrozek via FreeIPA-users wrote:
On Wed, Jun 28, 2017 at 01:03:45PM -0400, Chris Dagdigian via
> Hi folks,
> I have a set of servers that CANNOT become enrolled IDM clients due to a
> vendor refusing to support this type of config.
> This server fleet is directly bound to an AD system via the standard non-IPA
> "realm join ..." type commands
> Since I can't bring these servers "into the fold" so to speak at the
> least I would love to offset at least one potential future problem by seeing
> if I can help them configure sssd.conf on their local machines to use the
> same AD SID-to-UID algorithm (complete with custom ID Range values that we
> have enabled on the IPA master) so that they at least get the same UID and
> GID values for their AD users as the same user would get if they logged into
> the much larger fleet of IDM-managed servers.
> Hope I'm asking the question properly -- in a nutshell I'm wondering how to
> trick a standalone sssd.conf file so that it uses the same SID-to-UID
> algorithm that an IDM master would use. This would at least let me get
> consistent UID/GID values across my fleet of enrolled vs. non-enrolled IDM
> clients ! Tips or advice appreciated even if the response is "heck no; you
> can't do that .. "
So is the requirement absolutely to have the machines enrolled as part
of the AD domain?
If not, have you considered pointing the clients towards the compat tree
and using a plain LDAP setup, if your vendor supports that?
What Jakub pointed out would be the way which currently would work.
Defining the ID ranges in sssd.conf in a completely flexible way is
currently not possible. There is https://pagure.io/SSSD/sssd/issue/2651
which tracks this feature although the title might be a bit misleading.
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org