Thanks for letting me know, I'd tried with 1.4.1 but that too had the same problem.
I'll do a checkout on the latest source to make sure it’s all working, and then file a
bug report with RHEL since it's quite important for AD integration and offers numerous
benefits over plain old LDAP/Kerberos.
Thanks again for your help,
From: Stephen Gallagher [mailto:email@example.com]
Sent: 07 December 2010 15:49
To: Development of the System Security Services Daemon
Cc: Chris Bridson (TOC)
Subject: Re: [SSSD] Help with AD 2003 (with SFU) and groups
-----BEGIN PGP SIGNED MESSAGE-----
On 12/07/2010 08:18 AM, Chris Bridson (TOC) wrote:
I wonder if it's possible to get a little help/debugging with the config
of my sssd.conf for nested group membership.
We're using LDAP (provided via an AD 2003 forest and the SFU schema) and
Kerberos. It works fine with nss_ldap on RHEL and returns all groups a
user is a memberOf.
AD 2003+SFU should be using ldap_schema = rfc2307bis and leaving
ldap_group_member at the default (which is member).
However, there's a problem. You're hitting bug
because your groups have
parentheses in the name. In SSSD 1.2.x (which is what is currently in
RHEL) we weren't properly excaping the search filters for users and
groups, so we're getting an internal error that the filter can't be
parsed, because it's not a valid LDAP search filter.
This is fixed upstream in SSSD 1.5.0, which is scheduled for inclusion
in Fedora 15 and in upcoming RHEL releases. If you need this fix
backported to 1.2.x for a currently-supported RHEL release, please open
a bug at http://bugzilla.redhat.com
against SSSD in the appropriate
release and it will be evaluated for an earlier errata.
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----