On Tue, 03 Sep 2019, Tom K. via FreeIPA-users wrote:
Tinkered around some more. This works:
LDAPTLS_CACERT=/etc/ipa/ca.crt ldapsearch -Y GSSAPI -H ldaps://idmipa03.mws.mds.xyz:636
-D "uid=admin,cn=users,cn=accounts,dc=mws,dc=mds,dc=xyz" -w
"<SECRET>" -b "cn=compat,dc=mws,dc=mds,dc=xyz"
"(uid=tom(a)mds.xyz)" -v|grep dn
Compat tree internal look up triggers on a particular request pattern, as described in
RFC 2307, section 5.2. For AD integration, the user or group name must be a
fully-qualified one (tom(a)mds.xyz). It is later passed to SSSD for actual
search. Thus, searches like 'uid=*' will not work.
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland