I have two more questions for my own knowledge and maybe those of others :

* 1st question :
If 2 users, a local user called "aminata" and a domain user "aminata@domain" exist, how does sssd choose who we are when we ssh in the system with a username of "aminata" and the re_expressions is set to:

"(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))"

which allows three different styles for user names:
• username
username@domain.name
• domain\username
?

* 2nd question :
If we have two AD domains A and B. A linux machine is in the domain B, and we want the users from domain A to be able to authenticate in the linux machine. Our sssd configuration is id_provider=ldap (ldaps://auth.domainA.com), auth_provider=krb5 (auth.domainA.com). A keytab was generated for the linux machine on domain B AD and installed on the machine. Is this architecture possible without using a trust relationship from domain A to domain B ? My first thought is that it's not possible since the linux system belonging to domain B needs to be able to browse the directory of domain A.

Thanks in advance for your replies.

Mathieu

Le 26/06/2013 23:10, Jakub Hrozek a écrit :
On Wed, Jun 26, 2013 at 08:23:40PM +0200, Mathieu Bouillaguet wrote:
I solved my problem thanks to your reply :-)

For the others, my access provider is ldap and I didn't configured the
ldap_access_filter. If ldap_access_filter isn't configured and filter is in
the ldap_access_order (which is the default when it's not specified) all
users are denied access.

After having configured ldap_access_filter with a valid
memberOf=cn=authorizedUsersGroup, ou=... and added my users to this group
on the DC everything work as expected.

Hi Mathieu,

you're not the first to run into this issue, so the latest SSSD versions
clarify the access order better in the man pages.

I'm glad it's working for you now!
_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel