login with shortname in AD cross realm
by Longina Przybyszewska
Hi,
Is it possible to configure SSSD to make possible to login with short names across trusty domains?
The sAMAccount name attribute in AD are unique, and all users have Posix attributes assigned so there is no risk for name mismatch between different domains.
I use ad provider and all default setting for AD backend(gc_search_enable) ;
If use_fully_qualified_names = False only users from client machines native domain can login with shortnames; Users from other domains are "unknown".
I can successfully make ldapsearch to Global Catalog in top domain for login names=shortname for users from different domains:
ldapsearch -H ldap://ldap.c.example.com:3268 -Y GSSAPI -N -b "dc=c,dc=example,dc=org" "(&(objectClass=user)(sAMAccountName=user))"
user = user-a from a.c.example.org
user = user-b from b.c.example.org
best,
Longina
9 years, 2 months
AutoFS and variables
by Brendan Kearney
i want to have an automount configured so that
nas.bpk2.com:/export/music is mounted on /home/<username>/Music. i want
to use the HOME variable, but several attempts have not gotten the job
done. i have tried $HOME/Music, ${HOME}/Music, and {$HOME}/Music, and
none have worked.
what is the correct way to use a variable with AutoFS and SSSD? i have
used the hard values to get things working for my id, but want to have
this work for all users.
dn:
automountKey=/home/brendan/Music,automountMapName=auto.shares,cn=autofs,ou=Daemons,dc=bpk2,dc=com
automountinformation: nas.bpk2.com:/export/music
automountkey: /home/brendan/Music
description: music
objectclass: automount
objectclass: top
thanks,
brendan
9 years, 2 months
issue binding to LDAP using SSSD
by Ben Lewis
Hey All
This is my first attempt at getting sssd working. A little background.
I have a RHEL 6 server that is located on a secure DMZ like subnet, there
is an ldap server running on the network which I would like to authenticate
my server to. I have followed several guides (sssd fedora guide, official
red hat guide and several others), but just can't seem to get the binding
to work.
I have tested binding with the ldapsearch commands and that seems to work,
however SSSD continues to have issues.
I am binding on 389 with TLS. I can successfully bind and see all the users
and other attributes with the following ldapsearch command:
$ldapsearch -x -ZZ -H ldap://myhost.mydomain.com -b o=MYORG
This is what my /etc/sssd/sssd.conf looks like:
[sssd]
config_file_version = 2
services = nss, pam
domains = LDAP
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
entry_cache_timeout = 300
[pam]
[domain/LDAP]
access_provider = ldap
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
access_provider = ldap
ldap_access_filter = allow
ldap_schema = rfc2307
ldap_uri = ldap://myhost.mydomain.com
ldap_search_base = o=MYORG
ldap_user_search_base = ou=PEOPLE,o=MYORG
enumerate = True
cache_credentials = true
ldap_tls_reqcert = allow
ldap_tls_cacertdir = /etc/openldap/certs
ldap_id_use_start_tls = true
ldap_default_bind_dn = cn=ldaplookup,o=services
ldap_default_authtok_type = password
ldap_default_authtok = XXXXXXXX
debug_level = 9
I have also tried binding anonymous, which also fails. This is what I see
in my sssd log file:
http://pastebin.com/j1XVRR65
Thanks!
--
Ben Lewis
9 years, 2 months