Hello list,
there is patch set attached resolving: https://fedorahosted.org/sssd/ticket/2828
You can also see: https://github.com/celestian/sssd/commits/subdomains_v2
This patch set is without tests yet. I will send tests after Pavel B. refactor of AD provider.
I would like to remark couple of things:
1) Option ad_enabled_domains disabled by default.
2) We use labels master domain and root domain in code. Master domain belongs to one that SSSD is connected to. Root domain means AD forest root.
3) There is a lot of different environment setup. So this option has slightly different meaning in each of them.
4) There is secret feature if you forget fill in master domain to the option it will be added automatically.
What is this option good for? Let's imagine environment like:
A (forest root) | |-- S1 (SSSD client) | |-- B (AD client) | | | |-- S2 (SSSD client) | |-- C (AD client) | |-- D (AD client)
A ... forest root B, C, D ... AD clients S1 ... SSSD client connected to A S2 ... SSSD client connected to B
We could write:
* on S1: ad_enabled_domain = A, B, C and then S1 will not attempt to connect D.
* on S1: ad_enabled_domain = B, C the same as above because A is automagically filled in.
* on S2: ad_enabled_domain = A, C and then B is filled in automatically and S2 will not attempt to connect D.
* on S2: ad_enabled_domain = C and then B is filled in automatically and S2 will not attempt to connect D and A. (I am wondering that it is possible but it happened during manual testing.)
Regards