UNOFFICIAL
Hi Jakub,
Thank you very much!! Those changes seem to have worked :) We're currently running
1.12.4, but I think it will take several RHEL releases for the official RHEL repositories
to catch up to recent SSSD versions.
1) Is there a way to query the SID for the domain from the command-line?
I'd like to be able to populate the 'ldap_idmap_default_domain_sid' attribute
during the %post% section of my kickstart installs if possible.
Also, shortly after I got SSSD working on this machine (within an hour) I ran into the
intermittent authentication failures that I mentioned earlier.
Unfortunately after restarting SSSD with the log level turned up to 9 I've been unable
to replicate. I'll leave the log levels at 9 for a few days and send an extract
through when it recurs.
A.
-----Original Message-----
From: Jakub Hrozek [mailto:jhrozek@redhat.com]
Sent: Wednesday, 6 April 2016 21:44
To: sssd-users(a)lists.fedorahosted.org
Subject: [SSSD-users] Re: Inconsistent SSSD function [SEC=UNOFFICIAL]
OK, then I think you're hitting
https://fedorahosted.org/sssd/ticket/2828
As a matter of fact, we received another request via another channel about this feature so
we probably should just go and implement it.
Please note that in the recent versions (1.13.3?) even if we can't contact a trusted
domain, we still keep the online state, just disable the subdomains, so hopefully this
issue should not creep up so often, but the fix to only disable the trusted domains is not
completely reliable, so I still think it makes sense to implement #2828.
Can you try adding:
subdomains_provider=none
ldap_idmap_default_domain_sid = S-1-5-21-4042162558-766099810-1511815406
(Please double-check if I got the domain SID from the logs right..)