On Tue, 13 May 2014, Pavel Reichl wrote:
Hello,
Alexander has prepared attached patches, but he was not able to post
them himself as he is currently having bad connection.
Note that you cannot
currently test them on master (other than compile)
as master is broken with regards to AD integration in IPA mode due to
sdap maps code.
I've tested it by backporting to 1.11 branch (sssd-1-11) and it works
there quite well:
[root@master sssd]# id Administrator(a)AD.SAMBAXP
uid=894000500(administrator(a)ad.sambaxp) gid=894000500(administrator(a)ad.sambaxp)
groups=894000500(administrator(a)ad.sambaxp),894000512(domain admins(a)ad.sambaxp),
894000519(enterprise admins(a)ad.sambaxp),894000518(schema admins(a)ad.sambaxp),
894000520(group policy creator owners(a)ad.sambaxp),894000513(domain users(a)ad.sambaxp)
[root@master sssd]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: Administrator(a)AD.SAMBAXP
Valid starting Expires Service principal
13.05.2014 12:40:13 13.05.2014 22:39:49 host/master.ipa.sambaxp(a)IPA.SAMBAXP
renew until 14.05.2014 12:39:47
13.05.2014 12:40:13 13.05.2014 22:39:49 krbtgt/IPA.SAMBAXP(a)AD.SAMBAXP
renew until 14.05.2014 12:39:47
13.05.2014 12:39:49 13.05.2014 22:39:49 krbtgt/AD.SAMBAXP(a)AD.SAMBAXP
renew until 14.05.2014 12:39:47
[root@master sssd]# ssh -k -l Administrator(a)AD.SAMBAXP `hostname`
Last failed login: Tue May 13 13:27:38 EEST 2014 from master.ipa.sambaxp on ssh:notty
There were 2 failed login attempts since the last successful login.
Last login: Tue May 13 12:41:21 2014 from master.ipa.sambaxp
-sh-4.2$ klist
klist: No credentials cache found while retrieving principal name
-sh-4.2$ logout
Connection to master.ipa.sambaxp closed.
Backported patch 0001 is attached. There is no well-known SIDs support
in 1.11 so the patch is not needed there.
--
/ Alexander Bokovoy