On Tue, Apr 14, 2015 at 10:39:53AM +0300, Dimitar Dimitrov wrote:
Hello everyone.
I managed to configure ssh login for users by using pam_sss to our AD.
The users use their usePrincipalName to authenticate. The providers for each
of the domains are:
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
For the main domain this configuration works perfectly because the
sAMAccountName is the same as the name(the first part from the
user(a)domain.tld).
But when I tried to configure one of the other domains I stuck in a
following problem:
The sAMAccountName of the users is differ than the UPN. For example user
with UPN "test.linksync(a)linkoffice.fr" has a SAM "LINKSYNC".
When I try to get the user info for this by:
getent passwd test.linksync(a)linkoffice.fr
the authentication providers tries to get the user object from the LDAP with
the following filter:
[(&(userPrincipalName=test.linksync)(objectclass=user)(userPrincipalName=*)(objectSID=*))]
I thing that the problem here is with the id_provider. I tried to configure
the re_expression and full_name_format options but they did not change
anything in the request filter.
Is there а way to change the behavior with which the id_provider gets the
user object from the tree. For example I want to ask the ldap with the
format user@domain and not only name.
For example users logs with "test.linksync(a)linkoffice.fr" and the request
for the id should be
[(&(userPrincipalName=test.linksync(a)linkoffice.fr)(objectclass=user)(userPrincipalName=*)(objectSID=*))]
I think it's because you're using id_provider=ldap and not
id_provider=ad. The AD provider uses a different re_expression by
default which would match the UPNs.
I just tested login by UPN with ad provider and it works fine here,
even for a user with non-standard UPN suffix:
(Tue Apr 14 04:58:28 2015) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): Requesting
info for [upntest@another.suffix(a)AD.EXAMPLE.COM]
Is there any reason not to use id_provider=ad? Your configuration could be
much simpler and you'd get support for trusted domains in the same
forest automatically (and more features, like GPOs or DNS updates..)
See:
https://fedorahosted.org/sssd/wiki/Configuring_sssd_with_ad_server
If you really really need ldap provider for some reson, the default AD
provider re_expression is:
"(((?P<domain>[^\\\\]+)\\\\(?P<name>.+$))|" \
"((?P<name>[^@]+)(a)(?P<domain>.+$))|" \
"(^(?P<name>[^@\\\\]+)$))"
(taken from source file, hence the linebreaks).