by Licause, Al (CSC AMS BCS - UNIX/Linux Network Support)
I'm working with a customer that has implemented the sudoers schema on their ldap server and
I'd like to know if there are any components that must be placed in sssd.conf to get this to work.
The man sudoers.ldap only mentions ldap.conf and not sssd.conf. So to enable sudoers on
ldap, do we need both sssd.conf and /etc/ldap.conf ?
If this can all go in sssd.conf, which directives are necessary and what is the correct syntax ?
The FreeIPA team is happy to welcome you to a Fedora Test Day that is
being held on Thursday, July 25th.
We would like to invite you to take part in testing of the upcoming FreeIPA 3.3
release containing 2 major improvements for easier deployment of FreeIPA Active
Directory Trust feature to existing environments:
1) Use POSIX attributes defined in Active Directory 
With previous FreeIPA releases, users coming from Active Directory to FreeIPA
managed machines were always assigned POSIX attributes (UID and GID) by
However, in some deployments, Active Directory users and groups already have
defined custom POSIX attribute values (UID and GID), which may then be
leveraged on Linux machines via other 3rd party Active Directory integration
solutions. Administrator may choose to keep the values to not disrupt file
With FreeIPA 3.3, FreeIPA Active Directory Trust may be configured to use these
attributes when Active Directory user authenticates to Linux machines.
2) Expose POSIX data on legacy systems without recent SSSD
Administrators may have a deployment of machines which cannot use the recent
SSSD with Active Directory Trust support but would still like to be able to
authenticate with Active Directory user to these machines. This may affect for
example older Linux machines, UNIX machines.
With FreeIPA 3.3, Administrator may configure a compatibility LDAP tree which
will contain identities of the Active Directory users to the legacy systems.
These systems may then leverage standard LDAP authentication in this tree
allowing selected Active Directory users to authenticate.
To read more about the Test Day and suggested tests, see the following link:
Thank you for your help and participation!
The FreeIPA team
=== SSSD 1.10.1 ===
The SSSD team is proud to announce the release of version 1.10.1 of
the System Security Services Daemon.
As always, the source is available from https://fedorahosted.org/sssd
RPM packages will be made available for Fedora 19 and rawhide shortly.
== Feedback ==
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
== Highlights ==
* Another case where the dircache might have been created with the UID
of root was fixed
* Fixed a sssd_be crash in case the dynamic DNS update timed out
* Several packaging bugs that were introduced as a result of splitting
out the providers into separate subpackages was fixed
* The SRV resolution status is now correctly reset after receiving
notification about changed network conditions
== Tickets Fixed ==
Do not copy special files when creating a home directory from a skeldir
Empty Kerberos passwords handled incorrectly
Cannot change expired password of an AD user
cyclic group memberships may not work depending on order of operations
sssd fails to resolve hosts/services once the network is up
Several translated man pages are malformed
sssd-common requires libndr due to pac responder dependency
AD dyndns update crashed after attempting to update a standalone DNS server
shadowLastChange updates even when PAM reports password change failed
cc_residual_is_used might not work correctly with dircache
== Detailed Changelog ==
Jakub Hrozek (5):
* Updating the version for the 1.10.1 release
* RPM: Move sssd_pac to the krb5-common subpackage
* DB: sysdb_search_user_by_name: search by both name and alias
* RPM: Require libsss_idmap from sssd-common
* Updating translations for the 1.10.1 release
Jim Collins (1):
* ldap: only update shadowLastChange when password change is successful
Lukas Slebodnik (2):
* Return right directory name for dircache
* Every time use permissive control in function memberof_mod.
Michal Zidek (1):
* Always set port status to neutral when resetting service.
Ondrej Kos (5):
* Do not copy special files when creating homedir
* KRB5_CHILD: Fix handling of get_password return code
* Do not try to set password when authtok_length is zero
* KRB: Handle empty password gracefully
* KRB: Replace multiple calls with variable
Pavel Březina (3):
* print hint about password complexity when new password is rejected
* dyndns timeout test: catch SIGCHLD handler events
* SIGCHLD handler: do not call callback when pvt data where freed
Stephen Gallagher (3):
* Move pre and post scripts to sssd-common
* Remove sysv->systemd upgrade routines
* Move sssd_pac binary to the IPA and AD providers
== Packaging Changes ==
* The sssd_pac binary is now owned by the IPA and AD providers
* The sysv->systemd upgrade routines were removed
* Several packaging fixes
i have a short question about how ldap lookups are done
and if it is possible to modify them.
At the moment i have a sssd(1.9.2) up and running fine with a ldapserver.
If a user tries to login with his username (ex. jsmith)
or by getent command (getent passwd jsmith),
sssd creates a ldap query with "uid=username".
I found this in the logs:
[sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400): calling
ldap_search_ext with [(&(uid=jsmith)(objectclass=posixAccount))] ...
ldapsearch for this user (jsmith)
Is it possible to change the default ldap lookup from sssd, using for
example "mail" or "cn" instead of uid ?
So the ldap lookup which is created by sssd does not look like this:
It should look like this one:
Maybe with a conf option
would to the job.
Of Course this would fail in this situation, but a user could then login
with his mailadress( john.smith(a)domain.tld )
via ssh for example, and get his usuall unixaccount "jsmith"
I don`t want a mapping or rewrite of the uid field.
The unixaccount name should still be filled by the uid field from ldap
ldap_user_name = mail
but then the unix account names are mapped to the mail attribute.
With a second "Domain Section" a user could use both "login names" to
login via ssh.
His Unix Account "jsmith" and his mail adress "john.smith(a)domain.tld".
Maybe someone knows if this is possible or not.
Thanks in advance
Scientific Computing and Services (SCS)
Karlsruher Institut für Technologie (KIT)
Steinbuch Centre for Computing (SCC)
Zirkel 2, Gebäude 20.21, Raum 206
Tel. : +49 721 608-46347
Fax : +49 721 32550
WWW : http://www.scc.kit.edu
KIT - Universität des Landes Baden-Württemberg und
nationales Forschungszentrum in der Helmholtz-Gemeinschaft
Thanks - and congratulations !
But, what does it mean in practice for multi domain AD environment that "Global Catalog is searched for identity information"? Can we drop ldap search per domain? Is that search full compatible with with ldap/domain search?
Is then autofs/automount support fully integrated in sssd since 1.10.0? No need for automount attributes in AD's ldap?
I would need that version implementation in Ubuntu - do you know which Ubuntu distribution would go with it?