Hi, We're having an issue getting sssd to lookup non-qualified names across our forest. From the documentation it appears this should be supported via lookups done to the global catalog or failing that, queries against all discovered subdomains.
Setup:
- Host is joined to
b.site.com., and is joined to the domain (net ads join)
- usernames and uid's are unique within the forest
What works:
Desired behavior:
- users from
site.com can use their non-qualified usernames to connect to the host
Current Config:
[sssd]
config_file_version = 2
override_space = _
services = nss,pam
debug_level = 9
ldap_group_nesting_level = 5
id_provider = ad
auth_provider = ad
default_shell = /bin/bash
ldap_id_mapping = false
use_fully_qualified_names = false
ad_enable_gc = true
Other notes:
- Made sure the following attributes were replicated to the global catalog: uidNumber,gidNumber,loginShell,unixHomeDirectory
- logs show that an ldap query is only attempted against
b.site.com for the non-qualified account.
- logs show that the root domain,
site.com is discovered along w/ its domain controllers.
- version 1.13.4 (ubuntu 16.04)
Any suggestions?
Thanks,
-Mike