Ok, I gave it a try (with an AD provider) and here are the bugs I
have found so far:
0. My configuration:
id_provider = ad
auth_provider = ad
chpass_provider = ad
cache_credentials = True
ldap_id_mapping = False
# ldap_sasl_authid = LOGINA$@DUBLIN.AD.S3GROUP.COM
1. Upgrade db database from the 1.8 versions (aka RHEL 6U3) does not
work. SSSD won't start (dies silently). I had to rm
/var/lib/sss/db/* to make it working.
2. sssd won't work when I specify correct ldap_sasl_authid (see the
example above). This is bad as I might have my krb5.keytab cluttered
with other (possibly not working) keys so I would like to keep the
possibility of specifying the ldap_sasl_authid manually.
3. This is a show stopper for me. I can not disable ID mapping as
the example above does not work for me:
Only users and groups w/ RFC2307 attributes are seen, NO id mapping
Users and groups who have defined RFC2307 attributes are displayed
fine (RFC2307 attributes honored), but also users & groups with
no RFC2307 attributes are displayed (RFC2307 attributes computed by
On 10/18/2012 11:23 AM, Jakub Hrozek wrote:
even though RHEL-6.4 is still brewing, I think there might be some
interest in trying out the 1.9.x series of the SSSD on RHEL-6.3.
So I went ahead and built the SSSD 1.9.2 in a RHEL-6.3 buildroot:
The NVR of these test packages will be lower than those in 6.4 to keep
the upgrade path clean. The only missing functionality is the PAC
responder, which means this SSSD version won't be able to work with
an AD domain that is in a trust relationship with an IPA 3.x domain. I
had to disable the PAC responder as it requires Kerberos 1.10.
Because some new functionality required tweaking the SELinux policy, you
will encounter AVC denials when the new fast cache is accessed. That
said, my quick smoke testing went fine and we will be glad to hear test
results or bug reports.
Using the repository comes with a warning - this is NOT an official Red
Hat supported repository. The packages have NOT gone through formal QA. If
it breaks your RHEL-6.3 installation, you get to keep the pieces.
This is the repo configuration I used:
name=SSSD 1.9.x built for latest stable RHEL
name=SSSD 1.9.x built for latest stable RHEL - Source
sssd-users mailing list