Thanks for a quick answer !
To answer your questions,
1. No, i dont have those attributes msSFU30UidNumber/msSFU30GidNumber.
However, i have uidNumber and gidNumber.
2. Hmm, i though we were running AD 2003R2 with SFU, but I'm a bit
uncertain.
Winsysman is on vacation so i cant really check with him either.
Hmm, in ldap.conf we've set these mappings, if that could help.
nss_map_objectclass posixAccount User
nss_map_attribute uid sAMAccountName
nss_map_attribute uniqueMember member
nss_map_attribute homeDirectory msSFUHomeDirectory
nss_map_objectclass posixGroup Group
I thought that as long as i got the ldap_search right, which seems to
be, calling ldap_search_ext with
[(&(cn=xx)(objectclass=person))][ou=People,dc=xx,dc=xx,dc=xx],
i would get some results out of it, even if the some attributes are
wrong, but maybe I'm mistaken.
I just tried changing to this in sssd.conf, but that didn't matter, same
result.
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
Any suggestions on how to proceed ?
/Patrik Martinsson, Sweden.
On 07/29/2010 01:32 PM, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/29/2010 07:17 AM, Patrik Martinsson wrote:
> --------------
> [domain/FOO]
> description = LDAP domain with AD server
> enumerate = false
> min_id = 1000
> id_provider = ldap
> auth_provider = ldap
> ldap_uri = ldaps://foo.bar:636
> ldap_schema = rfc2307bis
> ldap_default_bind_dn = cn=xx,ou=People,dc=xx,dc=xx,dc=xx
> ldap_default_authtok_type = password
> ldap_default_authtok = xx
> ldap_search_base = DC=xx,DC=xx,DC=xx
> ldap_user_search_scope = sub
> ldap_user_search_base = ou=People,dc=xx,dc=xx,dc=xx
> ldap_group_search_base = ou=Groups,dc=xx,dc=xx,dc=xx
> ldap_user_object_class = person
> ldap_user_name = cn
> ldap_user_uid_number = msSFU30UidNumber
> ldap_user_gid_number = msSFU30GidNumber
> ldap_user_home_directory = msSFU30HomeDirectory
> ldap_user_shell = msSFU30LoginShell
> ldap_user_principal = userPrincipalName
> ldap_group_object_class = group
> ldap_group_name = posixGroup
> ldap_group_gid_number = msSFU30GidNumber
> ldap_force_upper_case_realm = True
> ldap_tls_reqcert = demand
> ldap_tls_cacert = /etc/openldap/cacerts/CADOUBLE.cer
> ldap_tls_cacertdir = /etc/openldap/cacerts
> --------------
> Here's how a working ldapsearch looks like,
> ldapsearch -x -L -Hldaps://foo.bar/ -D
> 'cn=xxbind,ou=People,dc=xx,dc=xx,dc=xx' -w xxbindpwd -b
> 'dc=xx,dc=xx,dc=xx' '(&(cn=xx)(objectclass=person))' cn uid
> This returns, as expected cn/uid for the requested user.
>
>
Can you check an ldapsearch for whether msSFU30UidNumber actually
exists? First of all, in order to support UNIX/Linux clients, you need
to have Microsoft Services For Unix installed on the Active Directory
2003 or older server, or Subsystem for UNIX-based Applications installed
on Active Directory 2003R2 or newer.
Depending on which version of Active Directory you are running, the set
of attributes is different. For example, on AD 2003 (with SFU 3.5), the
attributes you set above will work.
However, for AD 2003R2 or AD 2008, there are a different set of
attributes which are fully RFC2307-compliant. This means that you can
just take the defaults for all attribute names in the SSSD and it should
work.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkxRZrIACgkQeiVVYja6o6NjXQCgmg5olskAgS5jEQp1KUMRqC07
KgoAniT4oZBTxUK8GcQYWBj1Ui1foXHw
=0jOx
-----END PGP SIGNATURE-----
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel