-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/08/2013 09:27 AM, Mathieu Bouillaguet wrote:
You're right, we don't need the [LOCAL] section. I removed
it. and
set domains to only the AD domain we use.
Still, I cannot resolv netgroups. When I execute the "getent
netgroup -s sss Linux.Global" command and I see a fatal error in
the log of sssd_nss.log :
Well, I see the problem. In
[domain/AOP]
...
use_fully_qualified_names = True
But you're not using a fully-qualified name in the lookup. So it can't
send the request to the AOP domain. You've passed a short name
(linux.global instead of linux.global!AOP), so it skips over domains
that require fully-qualified names. In general, fully-qualified names
don't work well with netgroups.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird -
http://www.enigmail.net/
iEYEARECAAYFAlHaxIEACgkQeiVVYja6o6OiLwCfeAkRmRZHxUmOPmCx3bIKqPyL
KYkAn0jfyaQBM88ASCVuiNYuJZ6P649I
=5kGN
-----END PGP SIGNATURE-----