On Tue, Apr 14, 2015 at 10:39:53AM +0300, Dimitar Dimitrov wrote:
I managed to configure ssh login for users by using pam_sss to our AD.
The users use their usePrincipalName to authenticate. The providers for each
of the domains are:
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
For the main domain this configuration works perfectly because the
sAMAccountName is the same as the name(the first part from the
But when I tried to configure one of the other domains I stuck in a
The sAMAccountName of the users is differ than the UPN. For example user
with UPN "test.linksync(a)linkoffice.fr" has a SAM "LINKSYNC".
When I try to get the user info for this by:
getent passwd test.linksync(a)linkoffice.fr
the authentication providers tries to get the user object from the LDAP with
the following filter:
I thing that the problem here is with the id_provider. I tried to configure
the re_expression and full_name_format options but they did not change
anything in the request filter.
Is there а way to change the behavior with which the id_provider gets the
user object from the tree. For example I want to ask the ldap with the
format user@domain and not only name.
For example users logs with "test.linksync(a)linkoffice.fr" and the request
for the id should be
I think it's because you're using id_provider=ldap and not
id_provider=ad. The AD provider uses a different re_expression by
default which would match the UPNs.
I just tested login by UPN with ad provider and it works fine here,
even for a user with non-standard UPN suffix:
(Tue Apr 14 04:58:28 2015) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): Requesting
info for [email@example.com(a)AD.EXAMPLE.COM]
Is there any reason not to use id_provider=ad? Your configuration could be
much simpler and you'd get support for trusted domains in the same
forest automatically (and more features, like GPOs or DNS updates..)
If you really really need ldap provider for some reson, the default AD
provider re_expression is:
(taken from source file, hence the linebreaks).