Sorry for the delay. Currently, I'm working around by using nfs3 with sec=sys, making
a local account in a password file, and manually matching the UID to the one in AD.
I'd like to make the real solution (NFSv4 sec=krb5) work tho. This don't scale too
good. :)
Right, so the backend was able to find the user, that's good. Do
you still see
that the user was not found in the NSS log?
The NSS log is reporting "User [bnordgren] does not exist in domain [default]!
(negative cache)"
Any chance the username as stored in AD could differ in case only
from
bnordgren? In general I would suggest using case_sensitive=false with AD.
Please note that the cache should be removed after flipping the
case_sensitive option.
I set "case_sensitive=false", restarted sssd, did "sss_cache -E" and
tried again with same results. The ldap bind succeeded. The ldap search also succeeded
(both are the bnordgren user) and returned user attributes. The NSS log reports that I do
not exist. (err msg above).
Case sensitive=false seems to squash the names (usernames and group names) to lower case.
Does it also set some sort of flag on the ldap query to request case insensitive matches?
Some groups have uppercase letters.
One thing which may be relevant is that our AD does not have gidNumber in it. Not on the
user objects and not on the group objects either. Two questions:
1] I note that the group query includes (&(gidNumber=*)(!(gidNumber=0))). How do I
turn that off? It will never find any groups that way.
2] Could sssd be silently failing to produce a user entry for me because some attributes
are missing in AD? I did turn id_mapping on, so I'd hope that make uidNumber and
gidNumber optional. (see snippet below:)
ldap_id_mapping = true
ldap_idmap_range_min = 20000
ldap_idmap_range_max = 1999999
ldap_idmap_range_size = 20000
Thanks for your help!
Bryce
This electronic message contains information generated by the USDA solely for the intended
recipients. Any unauthorized interception of this message or the use or disclosure of the
information it contains may violate the law and subject the violator to civil or criminal
penalties. If you believe you have received this message in error, please notify the
sender and delete the email immediately.