On Fri, Aug 22, 2014 at 09:23:40AM -0400, Andre Pitanga wrote:
Hi list-
I'm working on a project using Active Directory 2008 R2 with Identity Management for
UNIX service to provide authentication and identity for Linux users via sssd.
Using this setup, is it possible to have the Linux username and group name be the same
(e.g. user apache, group apache)? I've learned that the sAMAccountName attribute must
be unique across the domain but I'm not sure if sssd uses this attribute to
"translate" the UID and GID to names in Linux. Hope this makes sense!
Our sssd.conf is:
[sssd]
config_file_version = 2
debug_level = 0
domains =
example.com
services = nss, pam
[
domain/example.com]
id_provider = ad
access_provider = ad
# We rely on UNIX extended attributes in AD
ldap_id_mapping = false
enumerate = true
The group names should be OK for primary domain, but might be
problematic in a trusted domain.
I would recommend to remove enumerate=true from the config file, too.