Dear SSSD community, we have recently introduced new SSSD project web page at https://sssd.io. We would like to keep adding new content, we have plenty of ideas but we would also like to get some tips from you:
What articles would you like to see on the page? What knowledge gaps are hard to fill with existing documentation? Feel free to suggest both user and developer facing content.
Thanks, Pavel
Pavel,
To me, what was most helpful in the old documentation was the architectural discussions embedded in the enhancement requests. When the requests were satisfied.
Examples: use of short names in non-local domains auto-discovery of trusted domains
For instance, until I read that discussion I was unaware that if you turned off auto-discovery and explicitly defined each child domain, that sssd would no longer contact the global catalog (GC) and thus, full membership in universal groups was not found. Only if you turned on auto-discovery did the sssd code query the GC. this is not intuitive, so having that documentation was a great help.
Another example is the discussion of that better discovery algorithm for AD DCs. It came out in a recent sssd release, maybe in the last 6-9 months. But I can't find that algorithm discussion now.
Spike
On Wed, May 12, 2021 at 7:15 AM Pavel Březina pbrezina@redhat.com wrote:
Dear SSSD community, we have recently introduced new SSSD project web page at https://sssd.io. We would like to keep adding new content, we have plenty of ideas but we would also like to get some tips from you:
What articles would you like to see on the page? What knowledge gaps are hard to fill with existing documentation? Feel free to suggest both user and developer facing content.
Thanks, Pavel _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
Hi,
I'm coming from other OS - Arch Linux. So from my point of view:
- for NSS you pasted full config file and it is great https://sssd.io/docs/ad/ad-provider-manual.html#nss-pam-configuration - do the same for pam.d config so nobody gets confused - add info on which sssd/krb5 version it was tested, so it would be easier to troubleshoot if there is too old or too new sssd - I'd like to see some manual how to properly configure automount with AD with krb5 ticket authentication - some extra info about systemd-automount, if possible, if would work with DFS etc, as systemd-automount get's more popular (autofs was for some reason removed from Arch repos :( ) - maybe what is possible to fetch with GPO for Linux (printers with CUPS, shares with automount?), I read only this https://sssd.io/design-pages/active_directory_gpo_integration.html - more screenshots how to configure GPO, LDAP schema in Windows eg. I see in man sssd-ad line "When the autofs provider is set to “ad”, the RFC2307 schema attribute mapping (nisMap, nisObject, ...) is used, because these attributes are included in the default Active Directory schema.". It would be extra feature to read more on your website with screenshots - maybe PAM.D + AD configure of Smartcard implementation - I can't find myself in menu schema. I googled this site: https://sssd.io/design-pages/autofs_integration.html ; I have no idea how to get there if coming from htttps://sssd.io
Anyway, nowadays SSSD has great docs anyway! Thanks for your work!
----- Pawel
śr., 12 maj 2021 o 23:15 Spike White spikewhitetx@gmail.com napisał(a):
Pavel,
To me, what was most helpful in the old documentation was the architectural discussions embedded in the enhancement requests. When the requests were satisfied.
Examples: use of short names in non-local domains auto-discovery of trusted domains
For instance, until I read that discussion I was unaware that if you turned off auto-discovery and explicitly defined each child domain, that sssd would no longer contact the global catalog (GC) and thus, full membership in universal groups was not found. Only if you turned on auto-discovery did the sssd code query the GC. this is not intuitive, so having that documentation was a great help.
Another example is the discussion of that better discovery algorithm for AD DCs. It came out in a recent sssd release, maybe in the last 6-9 months. But I can't find that algorithm discussion now.
Spike
On Wed, May 12, 2021 at 7:15 AM Pavel Březina pbrezina@redhat.com wrote:
Dear SSSD community, we have recently introduced new SSSD project web page at https://sssd.io. We would like to keep adding new content, we have plenty of ideas but we would also like to get some tips from you:
What articles would you like to see on the page? What knowledge gaps are hard to fill with existing documentation? Feel free to suggest both user and developer facing content.
Thanks, Pavel _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
I read it as:
- Configuring automount with Kereberos authentication and more automount information. - Using trusted domains with non-qualified names (shortnames). - How auto-discovery of trusted domains works. - How auto-discovery of AD site works.
Correct me if I'm wrong. Also I added some more comments bellow.
On 5/13/21 1:05 PM, Paweł Szafer wrote:
Hi,
I'm coming from other OS - Arch Linux. So from my point of view:
- for NSS you pasted full config file and it is great https://sssd.io/docs/ad/ad-provider-manual.html#nss-pam-configuration
- do the same for pam.d config so nobody gets confused
This is problematic, since pam config has little but important differences between distributions (I remember a critical security issue when some distro copy&pasted Fedora configuration).
We can provide sample config for Fedora since that's what we use but we would like to rely on community to provide samples for other distributions.
- add info on which sssd/krb5 version it was tested, so it would be easier to troubleshoot if there is too old or too new sssd
Ack.
- I'd like to see some manual how to properly configure automount with AD with krb5 ticket authentication
- some extra info about systemd-automount, if possible, if would work with DFS etc, as systemd-automount get's more popular (autofs was for some reason removed from Arch repos :( )
- maybe what is possible to fetch with GPO for Linux (printers with CUPS, shares with automount?), I read only this https://sssd.io/design-pages/active_directory_gpo_integration.html
- more screenshots how to configure GPO, LDAP schema in Windows eg. I see in man sssd-ad line "When the autofs provider is set to “ad”, the RFC2307 schema attribute mapping (nisMap, nisObject, ...) is used, because these attributes are included in the default Active Directory schema.". It would be extra feature to read more on your website with screenshots
- maybe PAM.D + AD configure of Smartcard implementation
- I can't find myself in menu schema. I googled this site: https://sssd.io/design-pages/autofs_integration.html ; I have no idea how to get there if coming from htttps://sssd.io http://sssd.io
Would it help if "List of Design Pages" is highlighted in this case?
Anyway, nowadays SSSD has great docs anyway! Thanks for your work!
Thanks for the feedback.
Pawel
śr., 12 maj 2021 o 23:15 Spike White <spikewhitetx@gmail.com mailto:spikewhitetx@gmail.com> napisał(a):
Pavel, To me, what was most helpful in the old documentation was the architectural discussions embedded in the enhancement requests. When the requests were satisfied. Examples: use of short names in non-local domains auto-discovery of trusted domains For instance, until I read that discussion I was unaware that if you turned off auto-discovery and explicitly defined each child domain, that sssd would no longer contact the global catalog (GC) and thus, full membership in universal groups was not found. Only if you turned on auto-discovery did the sssd code query the GC. this is not intuitive, so having that documentation was a great help. Another example is the discussion of that better discovery algorithm for AD DCs. It came out in a recent sssd release, maybe in the last 6-9 months. But I can't find that algorithm discussion now. Spike On Wed, May 12, 2021 at 7:15 AM Pavel Březina <pbrezina@redhat.com <mailto:pbrezina@redhat.com>> wrote: Dear SSSD community, we have recently introduced new SSSD project web page at https://sssd.io. We would like to keep adding new content, we have plenty of ideas but we would also like to get some tips from you: What articles would you like to see on the page? What knowledge gaps are hard to fill with existing documentation? Feel free to suggest both user and developer facing content. Thanks, Pavel _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org <mailto:sssd-users@lists.fedorahosted.org> To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org <mailto:sssd-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org <mailto:sssd-users@lists.fedorahosted.org> To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org <mailto:sssd-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
I think you got it right.
For PAM.D full file with specific info that this would work in Fedora only would be ok. While ago (3-4 years maybe) I copied config from Redhat docs in Centos for SSSD and I found out month later that with config which I just copy/paste from those docs login with AD is working just fine, but pam.d would allow to login AD user with just simple [Enter]/blank password. Then I couldn't reproduce it on Fedora and Arch and somehow fixed it easy.
I think the menu item List of Design Pages would be good enough. Also I'd rename menu title "Learn" to simple "Docs" or "Documentation", so it would be consistent with page url https://sssd.io/docs/introduction.html and left submenu title.
----- Pawel
pt., 14 maj 2021 o 13:23 Pavel Březina pbrezina@redhat.com napisał(a):
I read it as:
- Configuring automount with Kereberos authentication and more automount
information.
- Using trusted domains with non-qualified names (shortnames).
- How auto-discovery of trusted domains works.
- How auto-discovery of AD site works.
Correct me if I'm wrong. Also I added some more comments bellow.
On 5/13/21 1:05 PM, Paweł Szafer wrote:
Hi,
I'm coming from other OS - Arch Linux. So from my point of view:
- for NSS you pasted full config file and it is great
https://sssd.io/docs/ad/ad-provider-manual.html#nss-pam-configuration
- do the same for pam.d config so nobody gets confused
This is problematic, since pam config has little but important differences between distributions (I remember a critical security issue when some distro copy&pasted Fedora configuration).
We can provide sample config for Fedora since that's what we use but we would like to rely on community to provide samples for other distributions.
- add info on which sssd/krb5 version it was tested, so it would be easier to troubleshoot if there is too old or too new sssd
Ack.
- I'd like to see some manual how to properly configure automount with AD with krb5 ticket authentication
- some extra info about systemd-automount, if possible, if would work with DFS etc, as systemd-automount get's more popular (autofs was for some reason removed from Arch repos :( )
- maybe what is possible to fetch with GPO for Linux (printers with CUPS, shares with automount?), I read only this https://sssd.io/design-pages/active_directory_gpo_integration.html
- more screenshots how to configure GPO, LDAP schema in Windows eg. I see in man sssd-ad line "When the autofs provider is set to “ad”, the RFC2307 schema attribute mapping (nisMap, nisObject, ...) is used, because these attributes are included in the default Active Directory schema.". It would be extra feature to read more on your website with screenshots
- maybe PAM.D + AD configure of Smartcard implementation
- I can't find myself in menu schema. I googled this site: https://sssd.io/design-pages/autofs_integration.html ; I have no idea how to get there if coming from htttps://sssd.io <
Would it help if "List of Design Pages" is highlighted in this case?
Anyway, nowadays SSSD has great docs anyway! Thanks for your work!
Thanks for the feedback.
Pawel
śr., 12 maj 2021 o 23:15 Spike White <spikewhitetx@gmail.com mailto:spikewhitetx@gmail.com> napisał(a):
Pavel, To me, what was most helpful in the old documentation was the architectural discussions embedded in the enhancement requests. When the requests were satisfied. Examples: use of short names in non-local domains auto-discovery of trusted domains For instance, until I read that discussion I was unaware that if you turned off auto-discovery and explicitly defined each child domain, that sssd would no longer contact the global catalog (GC) and thus, full membership in universal groups was not found. Only if you turned on auto-discovery did the sssd code query the GC. this is not intuitive, so having that documentation was a great help. Another example is the discussion of that better discovery algorithm for AD DCs. It came out in a recent sssd release, maybe in the last 6-9 months. But I can't find that algorithm discussion now. Spike On Wed, May 12, 2021 at 7:15 AM Pavel Březina <pbrezina@redhat.com <mailto:pbrezina@redhat.com>> wrote: Dear SSSD community, we have recently introduced new SSSD project web page at https://sssd.io. We would like to keep adding new content, wehave
plenty of ideas but we would also like to get some tips from you: What articles would you like to see on the page? What knowledge gaps are hard to fill with existing documentation? Feel free to suggest both user and developer facing content. Thanks, Pavel _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org <mailto:sssd-users@lists.fedorahosted.org> To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org <mailto:sssd-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org <mailto:sssd-users@lists.fedorahosted.org> To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org <mailto:sssd-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Do not reply to spam on the list, report it:
sssd-users@lists.fedorahosted.org
-
Pavel Březina -
Paweł Szafer -
Spike White