These patches add a new provider to SSSD: the AD provider. This provider
is designed to simplify communication with Active Directory 2008 R2 and
later. It may work with earlier versions of Active Directory, but we're
not planning to test or support them.
This set of patches adds the identity, auth and chpass providers. I will
be providing an access provider as well, but it's not ready and I wanted
to land these patches sooner rather than later. I also have not added
any manpages or the SSSDConfig API entries for the new options yet.
Those are also still forthcoming.
This provider can be configured for testing as follows:
{{{
[domain/AD.DOMAIN]
id_provider = ad
auth_provider = ad
chpass_provider = ad
ad_server =
dc1.example.com,
dc2.example.com, _srv_
ad_domain = AD.DOMAIN
case_sensitive = False
}}}
That should be all the configuration needed. The ad_server line can be
ommitted if SRV records for AD domain controllers exist in DNS. I'm
working on a way to eliminate the need for 'case_sensitive = False' as
well, but that's trickier than it sounds because it needs to be set in
the NSS responder, not just the back-end.
Patches 0001-0005 are minor enhancements to utility.
Patch 0001: Some logging enhancements for krb5_child
Patch 0002: KRB5_LOCATOR: Print the filename that couldn't be opened
Patch 0003: Drop memctx parameter of krb5_try_kdcip and fix a small
memory leak in the process.
Patch 0004: Converge the assorted IPA and KRB5 routines for setting up
the online/offline handlers into a common function that can also be
reused for the AD provider.
Patch 0005: Just change the name of the "AD-compatible" schema map for
the pure LDAP provider so it won't conflict with the one I'm adding to
the AD provider.
The following two patches add the "meat" of the new functionality. Sorry
for the size of the patches, but I couldn't find a sensible way to break
them up any further.
Patch 0006: Add AD identity provider
Patch 0007: Add AD auth and chpass providers