On Fri, Nov 29, 2013 at 03:17:44PM +0100, Ben Morrice wrote:
Hello,
I am trying to use sssd in our environment where unfortunately we
have a broken ldap implementation with no options to fix it.
We have an openldap implementation where our 'uid' field can contain
many attributes, some containing a 'uid' and others containing
'uid@functional-unit'. Some users have in their ldap account a
single 'uid@functional-unit' whereas others have 'uid' and
potentially many 'uid@functional-unit'.
sssd does the right thing for most cases with multiple attributes;
just providing the first returned attribute (which is 'uid').
However I am experiencing problems with users that have only a
'uid@functional-unit' entry.
I want to configure sssd so that both 'uid' and
'uid@functional-unit' are represented from sssd as 'uid'
I'm not sure there is a way to have both format represented as uid,
sorry.
Please see below for some examples of what i'm talking about and my
current configuration.
[~]$ getent passwd user1
user1:*:90001:20010:user1:/home/user1:/bin/bash
[~]$ getent passwd |grep user2
user2@functional-unit:*:85010:20010:user2:/home/user2@functional-unit:/bin/bash
[~]$
Note: I can't do a 'getent passwd user2' or 'getent passwd
user2@functional-unit' - neither options work.
You'd have to query the name as present in LDAP, that us
user@functional-unit. The reason it doesn't work out-of-the box is that
the SSSD uses username@domain to qualify entries in one particular
domain. You can change that setting with:
re_expression = (?P<name>.+)
in the [sssd] or [domain] section.
I would advise to fix your server..