-----Original Message-----
From: sssd-devel-bounces(a)lists.fedorahosted.org [mailto:sssd-devel-
bounces(a)lists.fedorahosted.org] On Behalf Of Jakub Hrozek
Sent: Wednesday, 25 January 2012 7:10 PM
To: sssd-devel(a)lists.fedorahosted.org
Subject: Re: [SSSD] Need a strategy to manage AD group names for unix
consumption
On Wed, Jan 25, 2012 at 05:51:38PM +1100, Greg.Lehmann(a)csiro.au wrote:
> We have many AD groups that don't have valid characters in them as
far as
> Unix group names are concerned.
Can you give an example of an invalid name? SSSD only requires that the
names are valid UTF8.
Examples that cause us problems are the space and ampersand (&) characters in group
names.
Group name length can also be a problem.
> We'd like to use these AD groups in Unix
> land without having to rename. In the past we have defined a
character
> mapping to fix the invalid characters, so use an altered name in
Unix
> land. The most important thing is the membership of the groups
which is
> properly maintained in Windows land. I was hoping to use the same
> character mapping and put the translated name into a spare
Attribute of
> the AD group. The one that looks suitable is msSFU30Name but
trying this
> does not seem to work.
>
Please note that group memberships in AD are determined by member DNs,
not just usernames.
>
>
> I am testing by putting this line in my sssd.conf file
>
>
>
> ldap_group_name = msSFU30Name
In general yes, this is how you tell SSSD to look at non-default
attribute for the name.
>
>
>
> For groups with this Attribute set, the id command shows the gid
> (gidNumber set in AD) of the group but no group name. For those
groups
> without a value in msSFU30Name I see the AD group name as well as
the gid.
> For those groups with invalid characters in the name I see no
mention at
> all in the id command output.
>
It does seem to be working, just that the id command can't cope. If I
use the getent command that I saw somebody suggest in a previous note
like this:
getent group msSFU30Namevalue
then I see what I would expect.
>
> I guess I have 2 questions - 1. Should this work? 2. If it won't
work
> are there any other suggestions to solve the group name character
set
> problem.
>
>
>
Posting a snippet of logs when SSSD is looking up a group as well would
certainly be helpful, as well as an example of invalid group name.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel