Hello,
We want to switch from winbind to sssd. We have been using winbind for many years and have a configuration that does not seem to be compatible with sssd, at least I have not been able to find one.
We use several Windows Active Directory servers. When we started using winbind, there were relatively few Linux hosts. Most of our clients and servers had a Windows operating system.
We decided to go with rid backends at that time. It works very well. Here are the settings from /etc/samba/smb.conf:
# UID & GID Mapping with RID
idmap config DOMAIN1:backend = rid
idmap config DOMAIN1:range = 100000-349999
idmap config DOMAIN:base_rid = 0
idmap config DOMAIN2:backend = rid
idmap config DOMAIN2:range = 350000-599999
idmap config DOMAIN2:base_rid = 0
idmap config *:backend = tdb
idmap config *:range = 600000-849999
Now we would like to obtain the IDs of the users and groups in order to have a very low impact on the productive systems.
We have found the appropriate setting for our primary domain (DOMAIN1). However, we have not yet found a way to implement this for our trusted domain (DOMAIN2).
Here are the settings from /etc/sssd/sssd.conf:
[sssd]
domains = example1.com
default_domain_suffix = example1.com
config_file_version = 2
services = nss, pam
[domain/example1.com]
access_provider = ad
id_provider = ad
krb5_realm = EXAMPLE1.COM
krb5_store_password_if_offline = True
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/.krb5cc_%U
full_name_format = %1$s
default_shell = /bin/bash
cache_credentials = True
realmd_tags = manages-system joined-with-adcli
fallback_homedir = /home/DOMAIN1/%u
override_homedir = /home/DOMAIN1/%u
ad_domain = example1.com
use_fully_qualified_names = True
ldap_id_mapping = True
ldap_schema = ad
ldap_idmap_default_domain = example1.com
ldap_idmap_range_min = 100000
ldap_idmap_range_max = 349999
I hope you have a solution for me.
Regards
Ralf
We are testing a new SSSD configuration and we're almost there. Our campus Active Directory does not populate the RFC2307 fields (also there are several different Linux enclaves on campus). Authentication is done against campus AD. We have ID mapping pointing at a different LDAP server (OpenLDAP on RHEL 8.7). Our test client is RHEL 8.6. Our current successful setup is show below. We would like to avoid anything that is too obscure or not recommended. We have not found this to be a common configuration (not many examples). It is working for us, however.
. Install realm and sssd
. realmjoin to our domain (actually I used adcli to avoid DynamicDNS failures)
. Configured [sssd.conf]:
[sssd]
domains = university.edu
config_file_version = 2
services = nss, pam
debug_level = 8
[domain/university.edu]
ad_domain = university.edu
dyndns_update = false
krb5_realm = UNIVERSITY.EDU
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
auth_provider = ad
id_provider = ldap
ldap_uri = ldap://ldaptest.university.edu
ldap_default_bind_dn = cn=readonly,ou=system,dc=university,dc=edu
ldap_default_authtok = read_only_password
krb5_store_password_if_offline = True
default_shell = /bin/bash
use_fully_qualified_names = True
[nsswitch.conf]
passwd: sss files systemd
group: sss files systemd
(I've tried without "systemd" as well)
(We had initial problems configuring TLS, so we will address that next)
PROBLEM:
SSSD is correctly authenticating and pulling information from LDAP correctly. My UID and group memberships are correct. SSSD knows all of the groups and memberships.
The "id" command only shows my default group. The "getent group othergroup(a)university.edu" command gives an error:
error writing group entry: Invalid argument
Is there any fix for these? I found an older reference to "sss_showgroup", but that utility doesn't seem to be included in sss-utils anymore. We are running sssd 2.9.4.