Of course it should be possible to dig out that information by grepping logs or by using ldapsearch but with several domains configured (and in the future trusts and sub-domains also in play) it's getting a bit laborious to manually construct LDAP queries for each domain or plunge into cache files to find out information about a user's origin or group memberships instead of just doing something like "sss_search -u jdoe", just as Ondrej says.

If a specific action Ondrej suggests wouldn't work with certain types of domains the tool could just inform the administrator about the fact that those domains are not included in the results. The administrator could then decide next steps depending on the situation at hand, at least all the information possible to retrieve on the client side for the domains configured would be easily available.


Well, I understand that not all features would be available for all backends, but to be honest, to me is sssd synonym for a robust ldap-client - so I imagine sssd would be in a vast majority used with ldap/IPA backend.

As Marko said, "sss_search -u jdoe" would be nice. I also expect it to return more than what 'getent' does - i.e. things like mail address, telephone number,... ok these might not be important now, but certainly will be in the future (imagine sssd being queried by mailing client or ekiga/pidgin).

Also, having the information about ldap connection state (i.e. sssd running in connected or disconnected mode) is extremely useful to me as one the biggest pain with winbind is its cache - you never know which information came from the authoritative source and which was just cached & winbind can not bind to any server due to whatever reason.