On Tue, May 3, 2011 at 4:47 AM, Stephen Gallagher <sgallagh(a)redhat.com>wrote:
On Mon, 2011-05-02 at 21:56 -0700, Ben Kevan wrote:
> I'm wondering what the heck I'm doing wrong. I'm working on getting
> SSSD + KRB5 working against 2008 R2 AD. It's working fine in RHEL5 w/
> the standard LDAP.conf configuration. I'm working on sssd, but am not
> getting a binddn connection to AD. Here's my config:
...
> ldap_default_bind_dn = ldapbinddn(a)DOMAIN.COM
This is not a DN. This is a username. It's not the same thing. You need
to figure out ldapbinddn's full distinguished name in LDAP and use that.
This wasn't the issue. You're able to use both the full DN, or the
shortened
target method. It may not be documented, but if you're able to traverse AD
anonymously, then you'l ll be successful in the method above. This is how I
configured LDAP.con in RHEL5 even though it requested the usage of a full
DN.
> wtf am I doing wrong, and is ldap for authentication better then
> krb5? or should I stick with ldap for authorization and krb5 for
> authentication?
Using krb5 for authentication allows you to acquire a single-sign-on TGT
for use with other applications, so it's probably the preferred method
in your case.
The issue was the ldap_uri, where I had both targets space delimited and not
comma delimited.
However, I'm still having an issue with the results from getent passwd
<user>. Right now it's pulling / as homeDirectory, where homeDirectory
should report as /home/<user>. What mapping should this be on a 2008 R2
domain?
Also, pulling a getent group <groupname> I'm not egtting the correct list of
members as it is in AD (in the pure ad group and not in the msSFU30 portion)