I have two more questions for my own
knowledge and maybe those of others :
* 1st question :
If 2 users, a local user called "aminata" and a domain user
"aminata@domain" exist, how does sssd choose who we are when we
ssh in the system with a username of "aminata" and the
re_expressions is set to:
"(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))"
which allows three different
styles for user names:
- • username
- • username@domain.name
- • domain\username
?
* 2nd question :
If we have two AD domains A and B. A linux machine is in the
domain B, and we want the users from domain A to be able to
authenticate in the linux machine. Our sssd configuration is
id_provider=ldap (
ldaps://auth.domainA.com), auth_provider=krb5
(auth.domainA.com). A keytab was generated for the linux machine
on domain B AD and installed on the machine. Is this architecture
possible without using a trust relationship from domain A to
domain B ? My first thought is that it's not possible since the
linux system belonging to domain B needs to be able to browse the
directory of domain A.
Thanks in advance for your replies.
Mathieu
Le 26/06/2013 23:10, Jakub Hrozek a écrit :
On Wed, Jun 26, 2013 at 08:23:40PM +0200, Mathieu Bouillaguet wrote:
I solved my problem thanks to your reply :-)
For the others, my access provider is ldap and I didn't configured the
ldap_access_filter. If ldap_access_filter isn't configured and filter is in
the ldap_access_order (which is the default when it's not specified) all
users are denied access.
After having configured ldap_access_filter with a valid
memberOf=cn=authorizedUsersGroup, ou=... and added my users to this group
on the DC everything work as expected.
Hi Mathieu,
you're not the first to run into this issue, so the latest SSSD versions
clarify the access order better in the man pages.
I'm glad it's working for you now!
_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel