On Thu, Apr 07, 2016 at 02:10:39PM +1000, Kosseck, Adam MR wrote:
UNOFFICIAL
Hi Jakub,
Thank you very much!! Those changes seem to have worked :) We're currently running
1.12.4, but I think it will take several RHEL releases for the official RHEL repositories
to catch up to recent SSSD versions.
RHEL-6.8 will ship with 1.13.4 (1.13.3 with patches that would make the
RPM more-or-less equivalent to 1.13.4), but sadly we don't have a patch
for #2828 and it's too late for 6.8 at this point. I think 7.3 would
have it and chances are 6.9 might as well (but it's better to raise a
support request to let RH know that some customers want this
enhancement..)
By the way, both 6.8 and 7.3 will have the fix I mentioned earlier where
the trusted domains are at least marked as disabled, but not the whole
main domain. It's not bullet-proof, though, we still need to fix issues
like
https://fedorahosted.org/sssd/ticket/2976
1) Is there a way to query the SID for the domain from the command-line?
I'd like to be able to populate the 'ldap_idmap_default_domain_sid' attribute
during the %post% section of my kickstart installs if possible.
That's a good question and I didn't know how to do it myself. I admit I
mostly look into SSSD logs. But it looks like using:
# net rpc getsid -S dc.win.trust.test
where dc.win.trust.test is my test AD DC gives the expected output. But
maybe some of the developers more familiar with Samba would have a
better answer?
In SSSD we look at the attributes of the AD domain and extract the SID
from its binary form with the help of samba libraries.
Also, shortly after I got SSSD working on this machine (within an hour) I ran into the
intermittent authentication failures that I mentioned earlier.
Unfortunately after restarting SSSD with the log level turned up to 9 I've been
unable to replicate. I'll leave the log levels at 9 for a few days and send an
extract through when it recurs.
Yes, please do.
>
>
> A.
>
>
> -----Original Message-----
> From: Jakub Hrozek [mailto:jhrozek@redhat.com]
> Sent: Wednesday, 6 April 2016 21:44
> To: sssd-users(a)lists.fedorahosted.org
> Subject: [SSSD-users] Re: Inconsistent SSSD function [SEC=UNOFFICIAL]
>
> OK, then I think you're hitting
>
https://fedorahosted.org/sssd/ticket/2828
>
> As a matter of fact, we received another request via another channel about this
feature so we probably should just go and implement it.
>
> Please note that in the recent versions (1.13.3?) even if we can't contact a
trusted domain, we still keep the online state, just disable the subdomains, so hopefully
this issue should not creep up so often, but the fix to only disable the trusted domains
is not completely reliable, so I still think it makes sense to implement #2828.
>
> Can you try adding:
> subdomains_provider=none
> ldap_idmap_default_domain_sid = S-1-5-21-4042162558-766099810-1511815406
> (Please double-check if I got the domain SID from the logs right..)
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org