On 09/09/2013 04:28 AM, Jakub Hrozek wrote:
> On Sun, Sep 08, 2013 at 09:13:46PM -0400, Dmitri Pal wrote:
>> On 09/08/2013 06:07 PM, Jakub Hrozek wrote:
>>> On Sat, Sep 07, 2013 at 07:26:51PM -0400, Dmitri Pal wrote:
>>>> Hello,
>>>>
>>>> When one uses SSSD with AD provider but user comes from a subdomain
>>>> there are implications for the access provider. AFAIU we have a ticket
>>>> for simple access provider:
https://fedorahosted.org/sssd/ticket/2034
>>>> but what about other access providers? What are the implications? And
>>>> what would be the best practices in configuring SSSD in this case? What
>>>> access provider would we recommend?
>>>>
>>> Yes, I was thinking about these use cases after the recent sssd-users
>>> thread. The exact use-case that was described is very common so I think
>>> we should react.
>>>
>>> For the AD provider, I think we might add one more configuration option
>>> "ad_access_filter" that, if set, would augment the AD access
provider so
>>> that it first checks if the account is expired and if it's not, then
>>> proceed to check if the account matches the filter without having to
>>> configure the LDAP provider.
>>>
>>>> I envision a wiki page titled: "HOWTO/Selecting the best access
control
>>>> configuration for the SSSD AD provider". That should cover
different use
>>>> cases and give recommendations based on the use case.
>>> I agree. So I think we should open two tickets -- one for the
>>> documentation and one for the option. Do you agree?
>> Yes, and the one for option should start with a design page on wiki
>> extracting information from this thread.
> New option:
>
https://fedorahosted.org/sssd/ticket/2082
>
> Documentation:
>
https://fedorahosted.org/sssd/ticket/2083
>
> I also realized I didn't answer your original question about the other
> access providers and how they relate to subdomains. I think the fact
> that the subdomain access provider didn't work was quite a special case,
> because the main problem was that in the SSSD, it's not really easy to
> call a method of one provider (AD) from other provider (simple). If the
> types of the access providers are the same, which is typically the case,
> then we can safely call requests to refresh subdomains etc.
>
> QE actually even tests the IPA access provider (HBAC) for trusted users.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
You lost me a bit.
Is LDAP access provider going to do searches against global catalog or not?
If against GC everything should be fine but AFAIU it should be on a
different port 3268.
http://technet.microsoft.com/en-us/library/cc728188%28v=ws.10%29.aspx
If against LDAP then it will be just local and would not see subdomains
so rules for users from subdomains would not work.
So if you do:
access_provider = ldap
ldap_access_order = filter, expire
ldap_account_expire_policy = ad
ldap_access_filter = memberOf=cn=admins,ou=groups,dc=example,dc=com
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = CLIENT_SHORTNAME$(a)EXAMPLE.COM
ldap_schema = ad
it will cover only root domain and not subdomains because there is no
indication that the search should be against global catalog.
What am I missing?
Hm, you're right, I was already thinking with the new option in mind. We
need to accelerate the new option, then.