On Tue, 2011-05-10 at 21:34 -0700, Ben Kevan wrote:
Humm, the groups should be POSIX compliant, and currently contain only
POSIX compliant users. They work find in the previous methods of nss
mapping, but not with sssd.
Here's the portion where it looks for my group memberships:
(Tue May 10 21:17:48 2011) [sssd[be[default]]] [sdap_get_generic_send]
(6): calling ldap_search_ext with
[(&(memberuid=bkevan)(objectclass=group))][DC=Domain,DC=com].
Later in the debug logs I see:
(Tue May 10 21:17:51 2011) [sssd[be[default]]] [sdap_save_user_send]
(7): Original memberOf is not available for [bkevan].
(Tue May 10 21:17:51 2011) [sssd[be[default]]] [sdap_save_user_send]
(7): User principal is not available for [bkevan].
You should ignore those. They're informational, not errors. If those
attributes are available, we can do a few extra things.
So what should those be set to? ldapsearch doesn't show anything for
memberuid, and if I change that to uid, it still complains. What in
the output of ldapsearch should I be querying against to get a
successful group membership listing from 2008 R2 AD?
Your problem is that Active Directory is an RFC2307bis-compliant server,
rather than RFC2307. It uses the 'member' attribute (which is a DN, not
just a username). You need to set 'ldap_schema = rfc2307bis' in your
sssd.conf.
nss_ldap used to work because it did double-duty (it checked for both
RFC2307 and RFC2307bis members at all times). This is planned for the
future in SSSD (
https://fedorahosted.org/sssd/ticket/445), but right now
you have to select one or the other (defaulting to RFC2307 because it is
more common)