Could you file a bug against pam_mkhomedir?
I can definitely do this, though I'm not exactly sure what the bug is because I don't think I understand the problem fully. "mkhomedir.so doesn't play nice with aliased usernames"? Can you offer a little more guidance and/or explanation?

When running id_provider = ad, we default to operating in case-insensitive mode.
Is there a config option that exposes case sensitivity mode? If not, such a feature might be useful. Not sure if that is programmatically feasible/practical, though.

-Chris


On Wed, Oct 9, 2013 at 12:37 PM, Stephen Gallagher <sgallagh@redhat.com> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/09/2013 12:20 PM, Chris Hartman wrote:
> Well, in a related development, it appears there is a hardware
> issue with the testing PC- bad hard disk. Will replace, reinstall
> OS, and re-test.
>
> However, there is definitely a case sensitivity issue happening.
>
> My other hosts only have an issue when logging in with Guest as
> opposed to guest. Guest causes /home/guest to be created despite
> what's in the unixHomeDirectory attribute; then I'm always dropped
> in / because "Could not chdir to home directory /tmp/Guest: No such
> file or directory." I imagine this because sssd is lowercasing
> usernames but PAM isn't? "getent passwd guest" always returns the
> same result:
> guest:*:1596000501:1596000514:Guest:/tmp/Guest:/bin/bash

Hmm, that would be an interesting interaction problem. Yeah, PAM gets
passed *exactly* what you submit to it. Could you file a bug against
pam_mkhomedir? We probably want to have it normalize the lookup by
running getpwnam() itself to deal with aliased usernames (which is
essentially how we deal with case-insensitivity in SSSD; we treat the
name you passed in as an alias for the REAL user, which is the
lowercase version.).


>
> If I login in with guest, everything works as expected (after the
> cache is cleared). It seems strange that I'm even allowed to auth
> with both guest and Guest. Shouldn't one fail? Is this a bug or
> feature?
>

When running id_provider = ad, we default to operating in
case-insensitive mode. That's a feature.

Now, if they're not returning the same information, that would be a bug.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlJVhi0ACgkQeiVVYja6o6PK4QCfer+OI1eaSSeXJt6Az+61O0my
NXIAn3bG12hR9dStnSn4mY+lznj4LbaI
=RxO6
-----END PGP SIGNATURE-----
_______________________________________________
sssd-users mailing list
sssd-users@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users