On Thu, Apr 17, 2014 at 09:05:42AM +0300, Marko Myllynen wrote:
Hi,
On 2014-04-10 17:20, Jakub Hrozek wrote:
our current HOWTO[1] on connecting SSSD to an AD DC is outdated, mostly because the page still only introduces the LDAP provider. Recently, me, Sumit and Jeremy Agee wrote a new page that specifically advises to use the AD provider and also use realmd for setup: https://fedorahosted.org/sssd/wiki/Configuring_sssd_with_ad_server
We started a new page and kept the old one around mostly because pre-1.9 versions still need the LDAP provider info.
I'd like to get some review and feedback from our community so we can link the wiki page from the front page or the documentation section. In addition to the lists, I also CC-ed the individual contributors to the original page directly..I hope that's fine.
I've been pretty detached from all this during the past year but perhaps that's only a good thing for the review..
In general all looks very nice and it was certainly a good move to write a new document. I have few nitpick comments, please see below and address/ignore them as you see appropriate (and please pardon me if any of these are copypastes from something I wrote for the old document :).
That's exactly why I CC-ed you and the other authors of the original document -- you may remember strange quirks of the real environments :)
- I'd add LDP/ldapsearch examples to the GC section
Good idea, this might be helpful for the admin to compare the attribute set between GC and LDAP.
- for completeness sake I'd add dns_lookup_kdc = true and master_kdc =
server.ad.example.com to the krb5.conf example
I've added dns_lookup_kdc, but I'm not sure about master_kdc, why do you think it's needed? I normally prefer to stick to the defaults and let the autodiscovery do its magic.
- I'd add KRB5_TRACE=/dev/stdout kinit -V example somewhere, perhaps
after the krb5.conf example
I agree, added.
- I would at least comment out password server in smb.conf
Right, after re-reading the section in man smb.conf, I agree password server should not be used.
- a bit of grouping in smb.conf might make it more readable, e.g.
security/realm/workgroup could be the first block, then logging options (location+level), then server options, then client options
Done.
I've changed the wiki page accordingly. Thanks a lot for the suggestions!