We have many AD groups that don’t have valid characters in them as far as Unix group names are concerned. We’d like to use these AD groups in Unix land without having to rename. In the past we have defined a character mapping to fix the invalid characters, so use an altered name in Unix land. The most important thing is the membership of the groups which is properly maintained in Windows land. I was hoping to use the same character mapping and put the translated name into a spare Attribute of the AD group. The one that looks suitable is msSFU30Name but trying this does not seem to work.

 

I am testing by putting this line in my sssd.conf file

 

ldap_group_name = msSFU30Name

 

For groups with this Attribute set, the id command shows the gid (gidNumber set in AD) of the group but no group name. For those groups without a value in msSFU30Name I see the AD group name as well as the gid. For those groups with invalid characters in the name I see no mention at all in the id command output.

 

I guess I have 2 questions – 1. Should this work?   2. If it won’t work are there any other suggestions to solve the group name character set problem.

 

Greg