sssd-devel August 2024

sssd-devel@lists.fedorahosted.org

1 participants
1 discussions

Can sssd support a Microsoft AD to AD "Cross Forest One Way Selective Auth Trust"?
by Bob Green 27 Aug '24

27 Aug '24

A version of this question has been asked on the users mailing list, thought I'd ask here as well. Can sssd support a Microsoft AD to AD "Cross Forest One Way Selective Auth Trust"? I suspect no, considering the response by Sumit Bose to github issue #7280 "Multi domain configuration - can't get all gids for all groups where the user is member of": "you currently cannot mix group-memberships from different domains configured in sssd.conf by design. But as long as those two domains belong to the same forest i.e. the two domains (not forests)..." - Sumit. Unfortunately for me I'm dealing with 2 forests. User accounts reside in TRUSTED.corp.com, computer objects groups, service accounts reside in TRUSTING.corp.com. The TRUSTED.corp.com user accounts have foreignSecurityPrincipals in TRUSTING.corp.com which resemble: dn: CN=S-1-5-21-1234567890-1234567890-1234567890-1234567,CN=ForeignSecurityPrincipals,dc=trusting,dc=corp,dc=com objectClass: top objectClass: foreignSecurityPrincipal cn: S-1-5-21-1234567890-1234567890-1234567890-1234567 objectSid:: S-1-5-21-0987654321-0987654321-0987654321-0000011 where cn: <objectSid> would map to a user account in TRUSTED via it's <objectSid>. groups in TRUSTED.corp.com have members DNs of cn=<objectSid>,cn=ForeignSecurityPrincipals,dc=trusting,dc=corp,dc=com, such as: dn: CN=group1,ou=groups,dc=trusting,dc=corp,dc=com member: CN=S-1-5-21-1234567890-1234567890-1234567890-1234567,CN=ForeignSecurityPrincipals,DC=trusting,DC=com member: CN=S-1-5-21-1234567890-1234567890-1234567890-1234568,CN=ForeignSecurityPrincipals,DC=trusting,DC=com In order for sssd to understand that user1(a)TRUSTED.CORP.COM is a member of group1(a)TRUSTING.CORP.COM, sssd would need to maintain a map of user1's objectSID to the foreignSecurityPrincipal located in the trusting forest. I'm hoping someone on this list might be able to confirm that sssd is not currently an authentication client solution for the current backend architecture I've described here, or better yet tell me, yes this architecture is supported by sssd. Thank you for your development of sssd, Bob

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2024