On 06/05/2014 11:36 AM, Max Lock wrote:
Hi All,
I'm querying an AD server using LDAP lookups only. I can authenticate
a user just fine but the groups configured on the AD system aren't
relevant to what we're doing.
Looking at the the sssd-ldap man page, the ldap_group options look
like they may be used to modify the group lookups to look at user data
instead.
In each user record we have directReports: and manager: attributes.
Could these be used so that if Alice reports to Bob she's mapped to
the Bob group etc?
I am not sure if that would work. Bob is not a group object
class but a
user.
You might consider using IPA as a gateway and sync or trust AD. That
will give you AD user authentication and allow you to manage groups the
way you want.
-Cheers Max.
The information contained in this email, including any attachments, is intended solely
for use by the individual or entity named above and may be confidential. If you have
received this email in error please delete it and notify the sender immediately; you
should not retain the message or disclose its contents to anyone. Thank you. hibu (UK)
Limited, One Reading Central, Forbury Road, Reading, Berkshire, RG1 3YL, registered in
England No. 4205228. hibu Sales Limited, One Reading Central, Forbury Road, Reading,
Berkshire, RG1 3YL, registered in England No. 1403041. VAT registered number: GB765346017
© hibu (UK) Limited 2013. All rights reserved. hibu and other ™ are trademarks of hibu
(UK) Limited or its licensors.
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.