Hi,
Jeremy Agee from our QE team found out an inconsistency in how we handle
the home directory and shell fallbacks. If the fallback is set globally
in the [nss] section, then everything works as expected and the
fallbacks are honoured for all users. However, if the fallbacks are set
in the [domain] section, then they only apply for the parent domain, not
subdomains.
I think there is no reason to not inherit the overrides. Even though
there is separate subdomain_homedir override, that parameter serves a
different use case when the primary domain (typically IPA) has POSIX
attributes, but the subdomain does not.
For AD case, I think we should just inherit these settings when creating
the subdomain. The IPA server mode would use these values and they can
be picked up by legacy clients. Non-legacy clients do not have a way to
use the homedir and shell discovered on the server as the extop only
transmits name, UID and GID.
The other patch that is attached is meant to support the default homedir
expansion that contains user name. But because subdomain users have the
FQDN in the name attribute, the 'plain' username has to be extracted from
the FQDN until Michal finishes his refactoring.