So, I've got an....interesting problem...
At a new gig, who has been using a product Centrify to do unix auth for
systems for a while now (years and years). Now tha thte team is more built
up, we want to move away from this as a number of us have done sssd +
ldap+kerberos with AD a few times.
However, centrify has done some odd things with user and group objects. The
biggest issue of which is that 1). they are not normal
person/user/group/posixgroup objects...2). they keep the most important
attributes (uid, homedir, shell, etc). all stuffed info ONE attribute,
"keywords".
So, a ldap query of a user object ends up being this:
<snip>
objectClass: top
objectClass: leaf
objectClass: connectionPoint
objectClass: serviceConnectionPoint
cn: mn174
<snip>
name: mn174
objectGUID:: Kq81FaqN50eFDZK9+57CZQ==
keywords: shell:/bin/zsh
keywords: gecos:Matthew Nicholson
keywords: altGuid:
keywords: uid:133859
keywords: unix_enabled:TRUE
keywords: parentLink:S-1-5-21-1935655697-484061587-839522115-314656
keywords: home:/home/mn174
keywords: gid:2133859
</snip>
So, right now while i COULD get sssd to find the object, I can't get it to
pull out the important attributes like uid etc.
Is there any way to tell sssd to do attribute sub-queries? basically "the
uid is in keyword attribute, sub attribute uid" ?
I'm less that pleased this product did such things. Thank full it does have
a NIS server so worst case I'm going to dump all the users/groups and
import into AD proper (which DOES have the same account/group info, just
not with all the attributes @ the moment) .