No. But as I said, you are not supposed to use all capital fqdn. You
need to use your user/group name as it is.
are two different names -- the former is user name in POSIX and it is
case sensitive to the operating system but is case-insensitive in LDAP.
The latter is Kerberos principal which is case sensitive to Kerberos
In LDAP 'uid' attribute is compared case-sensitive, 'cn' attribute is
case-insensitive. For 'uid' we add a secondary value from SSSD
(normalized) if it is different from the original in request because
case-normalized searches wouldn't work otherwise. For 'cn' we don't
change anything because 'cn' comparison syntax in LDAP is
On Tue, May 30, 2017 at 2:27 PM, Alexander Bokovoy <abokovoy(a)redhat.com>
> On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote:
>> So I took a brand new user that I have never used in the system before (I
>> checked that the entry was not in the compat tree) and just ran an
>> command on Solaris system. I then looked in the
>> domain>/access log file on the ipa server, for the query and from the log
>> file, the query came in as all caps.
>> [~]$: id 831413(a)WIN.MYDOMIN.COM
>> [~]$: cat /var/log/dirsrv/slapd-<ipa domain>/access |grep 831413
>> [30/May/2017:13:34:38.637498942 -0400] conn=94124 op=622 SRCH
>> base="cn=users,cn=compat,dc=ipa,dc=mydomain,dc=com" scope=1
>> attrs="cn uid uidNumber gidNumber gecos description homeDirectory
>> [30/May/2017:13:34:38.651811322 -0400] conn=94124 op=622 RESULT err=0
>> tag=101 nentries=1 etime=0
>> However, the entry in the compat tree is all lowercase just like I
>> reported. I can reproduce this easily.
> memberUid value comes from SSSD look up. SSSD normalizes all names to
> low case.
> For group names, I'm not sure they are normalized, though.
>> Robert Johnson
>> On Tue, May 30, 2017 at 1:10 PM, Alexander Bokovoy <abokovoy(a)redhat.com>
>> On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote:
>>> Red Hat Enterprise Linux Server release 7.3
>>>> When looking at entries in the "cn=groups,cn=compat" tree, I
>>>> the entries for windows groups have the realm portion of the group name
>>>> all caps. This is true for the comment, the dn and the cn.
>>>> # domain users(a)WIN.MYDOMAIN.COM, groups, compat, ipa.mydomain.com
>>>> dn: cn=domain users(a)WIN.MYDOMAIN.COM
>>>> memberUid: 123456(a)win.mydomain.com
>>>> cn: domain users(a)WIN.MYDOMAIN.COM
>>>> When I look at the entries in the "cn=users,cn=compat" tree,
>>>> portion of the user name is all lower case. Incidentally, these same
>>>> names are also all lowercase in the "memberUid" option on the
>>>> # 123456(a)win.mydomain.com, users, compat, ipa.mydomain.com
>>>> dn: uid=123456(a)win.mydomain.com,cn=users,cn=compat,dc=ipa,dc=myd
>>>> homeDirectory: /home/win.mydomain.com/123456
>>>> uid: 123456(a)win.mydomain.com
>>>> Was this by design ?
>>>> Users and groups for AD users are inserted into the compat tree on
>>> demand, when a request comes mentioning them via LDAP query. The name is
>>> taken from the LDAP query.
>>> So it is your application(s) that are asking fully qualified user/group
>>> names with domain part capitalized.
>>> The reason I ask, is that when I try to use the "kinit" feature on
>>>> Solaris 10 systems (which is joined to the IPA domain) for this windows
>>>> user, I get an error.
>>>> [~]$ kinit
>>>> Password for 123456(a)win.mydomain.com:
>>>> kinit(v5): KDC reply did not match expectations while getting initial
>>>> If I run it like this:
>>>> [~]$ kinit 123456(a)WIN.MYDOMAIN.COM
>>>> Password for 123456(a)WIN.MYDOMAIN.COM:
>>>> [~]$ klist
>>>> Ticket cache: FILE:/tmp/krb5cc_1683378846
>>>> Default principal: 123456(a)WIN.MYDOMAIN.COM
>>>> Valid starting Expires Service principal
>>>> 05/30/17 11:44:35 05/30/17 21:44:40 krbtgt/
>>>> renew until 06/06/17 11:44:35
>>>> I believe this is due to the fact that the Solaris 10 system is using
>>>> lowercase entry in the compat tree above. Here is the result of the ID
>>>> command on this user:
>>>> [~]$ id
>>>> uid=1683378846(123456(a)win.mydomain.com) gid=1683378846(
>>>> I know this is a work around but I would prefer to make this easier on
>>>> end users. Any suggestions ?
>>>> You mix up Kerberos principals and user identities. They are different.
>>> In Kerberos protocol realm is case-sensitive. WIN.MYDOMAIN.COM
>>> the same realm as win.mydomain.com
. On Active Directory side this is
>>> hidden behind the Windows UI facade but on UNIX systems Kerberos
>>> libraries aren't hiding this fact.
>>> That's why you get "KDC reply did not match expectations .."
>>> message -- a realm name is used as part of Kerberos exchange and it is
>>> expected to be all upper cases.
>>> On identity front you have probably configured your Solaris systems to
>>> look up identities with upper cased fqdn and compat tree plugin inserts
>>> those as it is. I certainly don't see this behavior with other systems.
>>> / Alexander Bokovoy
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedo
> / Alexander Bokovoy
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org