On Wed, Apr 23, 2014 at 08:10:47AM +0200, Paul Liljenberg wrote:
Notice: I sent this email to the list using another mail address,
which i
believe whas not verified properly. If this emali is properly sent to the
list you can disregard moderating the message.
Hello
Im setting up a single signon solution for about 1200 servers. The
situation as it seems is that we are setting up all users in a windows 2008
r2 active directory, adding proper unix permissions. A user with proper
priveliges to read active directory is being used by sssd to read which
users is allowed in and not. If the users does not have a home directory
they are being created automatically. So whats the issue here? Access to
the system does not happen instantanely and i believe its because sssd is
polling active directory every 120 seconds. It seems as if it has issues
remaining its state and it is just as if it would loose its local database.
I would like to be able to have users being logged directly after a user is
being added to active directory. Is this possible and how could this be
achieved?
I would encourage you to turn enumeration off. Enumeration is a background
task that periodically downloads and saves all users from the server,
which can be very intensitve especially for large environments.
Also, is there a reason to use a bind user and a password and not a
keytab and then leverage GSSAPI?
We have some howtos on enrolling a client with AD for pre-1.9 clients:
https://fedorahosted.org/sssd/wiki/Configuring%20sssd%20to%20authenticate...
And also for 1.9 and later (recommended):
https://fedorahosted.org/sssd/wiki/Configuring_sssd_with_ad_server