On Fri, Apr 11, 2014 at 01:11:40PM +0200, Pavel Březina wrote:
On 04/10/2014 04:20 PM, Jakub Hrozek wrote:
>our current HOWTO on connecting SSSD to an AD DC is outdated,
>mostly because the page still only introduces the LDAP provider. Recently, me,
>Sumit and Jeremy Agee wrote a new page that specifically advises to use
>the AD provider and also use realmd for setup:
>We started a new page and kept the old one around mostly because pre-1.9
>versions still need the LDAP provider info.
>I'd like to get some review and feedback from our community so we can
>link the wiki page from the front page or the documentation section. In
>addition to the lists, I also CC-ed the individual contributors to the
>original page directly..I hope that's fine.
>Thank you for your comments.
nice article. I have just few nitpicks to sssd.conf.
>config_file_version = 2
>domains = ad.example.com
>services = nss, pam
># Uncomment if you need offline logins
># cache_credentials = true
>id_provider = ad
>auth_provider = ad
>access_provider = ad
I think presenting a minimal configuration would be better, ie
removing auth and access providers since they are inherited from id.
auth is inherited, access is not. The access provider defaults to permit
for all backends. We talked multiple times about changing the default, but
I'm not quite sure why we didn't. I remember there was a technical reason
(other than 'noone sent a patch') but I can't recall it now, sorry.
I can remove the auth_provider line, though.
># Uncomment if service discovery is not working
># ad_server = server.ad.example.com
># Uncomment if you want to use POSIX UIDs and GIDs
># ldap_id_mapping = False
IMHO this description is a little bit misleading. Since you use UIDs
and GIDs event it id mapping is turned on. It should say "if you
have UIDs and GIDs set on AD side" or something similar.
You're right, fixed with the sentence you proposed.