We're having an issue getting sssd to lookup non-qualified names across our forest. From the documentation it appears this should be supported via lookups done to the global catalog or failing that, queries against all discovered subdomains.
- Host is joined to b.site.com
., and is joined to the domain (net ads join)
- usernames and uid's are unique within the forest
- users from site.com
can use their non-qualified usernames to connect to the host
config_file_version = 2
override_space = _
services = nss,pam
debug_level = 9
ldap_group_nesting_level = 5
id_provider = ad
auth_provider = ad
default_shell = /bin/bash
ldap_id_mapping = false
use_fully_qualified_names = false
ad_enable_gc = true
- Made sure the following attributes were replicated to the global catalog: uidNumber,gidNumber,loginShell,unixHomeDirectory
- logs show that an ldap query is only attempted against b.site.com
for the non-qualified account.
- logs show that the root domain, site.com
is discovered along w/ its domain controllers.
- version 1.13.4 (ubuntu 16.04)