On Wed, Jan 25, 2012 at 05:51:38PM +1100, Greg.Lehmann(a)csiro.au wrote:
We have many AD groups that don't have valid characters in
them as far as
Unix group names are concerned.
Can you give an example of an invalid name? SSSD only requires that the
names are valid UTF8.
We'd like to use these AD groups in Unix
land without having to rename. In the past we have defined a character
mapping to fix the invalid characters, so use an altered name in Unix
land. The most important thing is the membership of the groups which is
properly maintained in Windows land. I was hoping to use the same
character mapping and put the translated name into a spare Attribute of
the AD group. The one that looks suitable is msSFU30Name but trying this
does not seem to work.
Please note that group memberships in AD are determined by member DNs,
not just usernames.
I am testing by putting this line in my sssd.conf file
ldap_group_name = msSFU30Name
In general yes, this is how you tell SSSD to look at non-default
attribute for the name.
For groups with this Attribute set, the id command shows the gid
(gidNumber set in AD) of the group but no group name. For those groups
without a value in msSFU30Name I see the AD group name as well as the gid.
For those groups with invalid characters in the name I see no mention at
all in the id command output.
I guess I have 2 questions - 1. Should this work? 2. If it won't work
are there any other suggestions to solve the group name character set
problem.
Posting a snippet of logs when SSSD is looking up a group as well would
certainly be helpful, as well as an example of invalid group name.