On Tue, Jun 30, 2015 at 02:15:27PM +0200, Jan Pazdziora wrote:
If for the applications realm is also useful, then a) the app can query the sssd dbus interface for the matching realm for the domain b) we can also return the realm, although the expectations should be set right in documentation that not all domain types have the realm info (LDAP domain for example)
So how about the reverse mapping? Going from realm to SSSD domain / section? Currently for example in mod_authnz_pam we consider them interchangeable -- we just take the principal name (either fully qualified or not) and pass it to pam_sss.so via pam_acct_mgmt to evaluate the access check. Should we get the SSSD domain / section value for that?
I've filed https://fedorahosted.org/sssd/ticket/2709 for some way to get the SSSD domain based on the realm.