On 09/09/2013 04:28 AM, Jakub Hrozek wrote:
On Sun, Sep 08, 2013 at 09:13:46PM -0400, Dmitri Pal wrote:
> On 09/08/2013 06:07 PM, Jakub Hrozek wrote:
>> On Sat, Sep 07, 2013 at 07:26:51PM -0400, Dmitri Pal wrote:
>>> Hello,
>>>
>>> When one uses SSSD with AD provider but user comes from a subdomain
>>> there are implications for the access provider. AFAIU we have a ticket
>>> for simple access provider:
https://fedorahosted.org/sssd/ticket/2034
>>> but what about other access providers? What are the implications? And
>>> what would be the best practices in configuring SSSD in this case? What
>>> access provider would we recommend?
>>>
>> Yes, I was thinking about these use cases after the recent sssd-users
>> thread. The exact use-case that was described is very common so I think
>> we should react.
>>
>> For the AD provider, I think we might add one more configuration option
>> "ad_access_filter" that, if set, would augment the AD access provider
so
>> that it first checks if the account is expired and if it's not, then
>> proceed to check if the account matches the filter without having to
>> configure the LDAP provider.
>>
>>> I envision a wiki page titled: "HOWTO/Selecting the best access control
>>> configuration for the SSSD AD provider". That should cover different
use
>>> cases and give recommendations based on the use case.
>> I agree. So I think we should open two tickets -- one for the
>> documentation and one for the option. Do you agree?
> Yes, and the one for option should start with a design page on wiki
> extracting information from this thread.
New option:
https://fedorahosted.org/sssd/ticket/2082
Documentation:
https://fedorahosted.org/sssd/ticket/2083
I also realized I didn't answer your original question about the other
access providers and how they relate to subdomains. I think the fact
that the subdomain access provider didn't work was quite a special case,
because the main problem was that in the SSSD, it's not really easy to
call a method of one provider (AD) from other provider (simple). If the
types of the access providers are the same, which is typically the case,
then we can safely call requests to refresh subdomains etc.
QE actually even tests the IPA access provider (HBAC) for trusted users.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
You lost me a bit.
Is LDAP access provider going to do searches against global catalog or not?
If against GC everything should be fine but AFAIU it should be on a
different port 3268.
http://technet.microsoft.com/en-us/library/cc728188%28v=ws.10%29.aspx
If against LDAP then it will be just local and would not see subdomains
so rules for users from subdomains would not work.
So if you do:
access_provider = ldap
ldap_access_order = filter, expire
ldap_account_expire_policy = ad
ldap_access_filter = memberOf=cn=admins,ou=groups,dc=example,dc=com
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = CLIENT_SHORTNAME$(a)EXAMPLE.COM
ldap_schema = ad
it will cover only root domain and not subdomains because there is no
indication that the search should be against global catalog.
What am I missing?
--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/