On Tue, Dec 06, 2011 at 09:05:07AM +0200, Stefan Lesicnik wrote:
>
> On Mon, Dec 05, 2011 at 12:37:35PM +0100, Jan Zelený wrote:
> > > Hi,
> > >
> > > I'm hoping someone can help. I am using RHEL 6.1 and trying to
> > > use sssd to
> > > authenticate to our ldap server.
> > >
> > > Our ldap server uses the uid=name@domain as the uid. sssd seems
> > > to pass the
> > > name part only. Below is the extract from log. This is generated
> > > by
> > > running getent passwd stefan(a)lsd.com
> > >
> > > Originally I had the issue where the @ part of the search was
> > > looking for a
> > > specific sssd provider. I changed my domain to
lsd.com. This lets
> > > me
> > > search but as you can see below, passes the filter of uid=stefan
> > > and not
> > > uid=stefan(a)lsd.com
> > >
> > > Thanks in advance,
> > > Stefan
> >
> > Hi Stefan,
> > as I suggested to you on our IRC channel, I still think you should
> > try setting
> > re_expression in the config file so it doesn't translate the part
> > after @ to a
> > domain name. This is what it could look like (not sure though, I
> > don't have a
> > setup which I can test this on):
> >
> > (?P<name>+$)
> >
> >
> > Please try that and let us know.
> >
> > Jan
>
> You can just fine-tune the re_expression so it uses a different
> character for name-domain delimeter. This would use the "~" sign:
>
> re_expression = (?P<name>[^~]+)~?(?P<domain>[^~]*$)
Thanks Jan, Jakub
I got it working by changing the re_expression as above. I guess this would be a common
request and this above re would be good in the manual somewhere.
The parameter is documented in sssd.conf(5) manual page. Do you feel
that an example of a custom regex would be prudent?
I also discovered I need SSL / TLS for auth, so now im fixing that.
Yes, SSSD will not send passwords over unencrypted connection. Don't
hesitate to ask if you run into trouble.