On Mon, Nov 18, 2013 at 10:56:16AM +0100, Pavel Březina wrote:
On 11/12/2013 01:32 PM, Jakub Hrozek wrote:
>Hi,
>
>we have a default_domain_suffix parameter in the SSSD with the following
>description:
>
> default_domain_suffix (string)
> This string will be used as a default domain name for all names without a
> domain name component. The main use case is environments where the primary
> domain is intended for managing host policies and all users are located in a
> trusted domain. The option allows those users to log in just with their user
> name without giving a domain name as well.
>
> Please note that if this option is set all users from the primary domain have
> to use their fully qualified name, e.g. user(a)domain.name, to log in.
>
> Default: not set
>
>This turned out to be a problem for one RHEL customer recently who uses
>the default_domain_suffix option because all his users and groups are
>stored in AD. But they also use automounter, which means all requests
>from automounter get fully qualified, auto.master becomes
>auto.master(a)trusted.ad.domain. And I don't think it's even possible to
>automounter to make the map name fully qualified (yes, you can override
>master map name, but then you'd have to also make sure all the nested
>map and key names are qualified which is insane..)
>
>I think that given we only support users and groups from trusted sources
>now, we should only consider the default domain suffix for users and
>groups.
>
>The customer was kind enough to propose a patch. I think it's correct,
>except maybe we should amend the option documentation. I can't think of
>any other part of SSSD that needs patching - sudo's input is username
>and ssh provider only takes the default domain suffix into consideration
>for users as well.
Ack to the patch.
I don't think it is necessary to amend the documentation but it will
not hurt :)
Pushed to master and sssd-1-11