On Tue, 2012-02-21 at 18:26 +0100, Ondrej Valousek wrote:
Well, I would like to see something like 'adquery' or
Centrify - i.e. tool that would:
1. enumerate maps like group, passwd, automount... getent can not do
This only works with AD because there is an alternative RPC-based
mechanism to ask for this information. In the general LDAP case, SSSD
can't get any more information than 'getent' is permitted.
2. Display information about a user (account active, disabled,
This is again not always possible to determine. Most LDAP servers use
server-side policy controls. We basically can't learn this information
until we try to authenticate in many cases.
3. Group membership - how was group membership computed (in ldap we
can have nested groups, not all groups have Unix attributes defined)
This might be a nice feature. Please file an enhancement ticket at
If you need an account, you can get one for free at
4. Status about connection to the domain
+ all details (like ldap controller being connected...)
This isn't really useful information much of the time, because we don't
always maintain a connection(it wastes resources on the server-side).
The most we could give you is whether the last attempt to contact the
server was successful, but this would probably be more misleading than
5. Version running
This was added in SSSD 1.7.0
In general some too that would help in case of any problems.
Reconfiguring sssd for higher debug level & restarting & inspecting
logs - this all takes a lot of time....
We added the ability to change debug levels without restarting SSSD in