[SSSD] Where do groups get created?

Simo Sorce ssorce at redhat.com
Thu Nov 12 03:06:21 UTC 2009


On Thu, 2009-11-12 at 11:28 +1000, David O'Brien wrote:
> Demonstrating ignorance again...
> 
> I have a very simple sssd implementation, only one local domain.
> 
> I have nsswitch.conf configured with
>   passwd sss
>   group sss
> 
> I can do sss_useradd, sss_groupadd, etc., and all works fine.
> I can do getent -s sss group|passwd and see what's going on.
> 
> What happens if I have more than one domain configured? Do I need to use 
> FQDN to specify where a user will get created?
> sss_useradd userName at otherDomain

You can but if you are not using fully qualified names at the backend
level (see the FQDN option) it is kind of useless as the system will
only get back one user given a name from the first backend.
If a domain uses fully qualified names the only way to get a user out is
by using the fully qualified name.

> Does this work for sss_groupadd?

No sss_tools work only against the local provider and it doesn't make
sense (and is not supported) to have more than one local provider.

> The closest I could get to this was the "re_expression (string)" entry 
> in the sssd.conf man page.

Don't touch that one :-)

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list