Hi,
with the patch set SSSD can resolve so called Well-Known SID, i.e. SIDs
with a special, hard-coded meaning.
Currently a man page entry for this feature is missing. I plan to add a
common section the sssd-ad and sssd-ipa man pages and a reference to
this section in the sssd.conf man page. The man reason to document it is
the introduction of reserved domain and user names. With the current
patches the reserved domain names are 'NT AUTHORITY' and 'BUILTIN'. The
reserved user names are 'NULL SID', 'Everyone', 'LOCAL',
'CONSOLE
LOGON', 'CREATOR OWNER', 'CREATOR GROUP', 'CREATOR OWNER
SERVER',
'CREATOR GROUP SERVER' and 'OWNER RIGHTS'. The tries to mimic the
behaviour of Samba and AD which return a domain or authority name for
S-1-5-[0-20] and S-1-5-32-* SIDs but none for S-1-[0-3] SIDs. For the
latter it would be possible to add domain/authority names (Null, World,
Local, Creator Authority). The leaves us with no reserved user names but
more reserved domain names. Any opinions what would be the better
approach?
A second question is about translation. At least some of the names for
the Well-Knowns SIDs are translated in localized version of Windows.
Shall we do the same? If yes, is it possible to mark the strings so
that the translators see that not a random translation is expected but
only the value Windows used in the corresponding localized version?
bye,
Sumit