-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/29/2010 07:17 AM, Patrik Martinsson wrote:
--------------
[domain/FOO]
description = LDAP domain with AD server
enumerate = false
min_id = 1000
id_provider = ldap
auth_provider = ldap
ldap_uri = ldaps://foo.bar:636
ldap_schema = rfc2307bis
ldap_default_bind_dn = cn=xx,ou=People,dc=xx,dc=xx,dc=xx
ldap_default_authtok_type = password
ldap_default_authtok = xx
ldap_search_base = DC=xx,DC=xx,DC=xx
ldap_user_search_scope = sub
ldap_user_search_base = ou=People,dc=xx,dc=xx,dc=xx
ldap_group_search_base = ou=Groups,dc=xx,dc=xx,dc=xx
ldap_user_object_class = person
ldap_user_name = cn
ldap_user_uid_number = msSFU30UidNumber
ldap_user_gid_number = msSFU30GidNumber
ldap_user_home_directory = msSFU30HomeDirectory
ldap_user_shell = msSFU30LoginShell
ldap_user_principal = userPrincipalName
ldap_group_object_class = group
ldap_group_name = posixGroup
ldap_group_gid_number = msSFU30GidNumber
ldap_force_upper_case_realm = True
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/openldap/cacerts/CADOUBLE.cer
ldap_tls_cacertdir = /etc/openldap/cacerts
--------------
Here's how a working ldapsearch looks like,
ldapsearch -x -L -Hldaps://foo.bar/ -D
'cn=xxbind,ou=People,dc=xx,dc=xx,dc=xx' -w xxbindpwd -b
'dc=xx,dc=xx,dc=xx' '(&(cn=xx)(objectclass=person))' cn uid
This returns, as expected cn/uid for the requested user.
Can you check an ldapsearch for whether msSFU30UidNumber actually
exists? First of all, in order to support UNIX/Linux clients, you need
to have Microsoft Services For Unix installed on the Active Directory
2003 or older server, or Subsystem for UNIX-based Applications installed
on Active Directory 2003R2 or newer.
Depending on which version of Active Directory you are running, the set
of attributes is different. For example, on AD 2003 (with SFU 3.5), the
attributes you set above will work.
However, for AD 2003R2 or AD 2008, there are a different set of
attributes which are fully RFC2307-compliant. This means that you can
just take the defaults for all attribute names in the SSSD and it should
work.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkxRZrIACgkQeiVVYja6o6NjXQCgmg5olskAgS5jEQp1KUMRqC07
KgoAniT4oZBTxUK8GcQYWBj1Ui1foXHw
=0jOx
-----END PGP SIGNATURE-----