[SSSD] Where do groups get created?
David O'Brien
davido at redhat.com
Thu Nov 12 06:33:37 UTC 2009
Simo Sorce wrote:
> On Thu, 2009-11-12 at 11:28 +1000, David O'Brien wrote:
>> Demonstrating ignorance again...
>>
>> I have a very simple sssd implementation, only one local domain.
>>
>> I have nsswitch.conf configured with
>> passwd sss
>> group sss
>>
>> I can do sss_useradd, sss_groupadd, etc., and all works fine.
>> I can do getent -s sss group|passwd and see what's going on.
>>
>> What happens if I have more than one domain configured? Do I need to use
>> FQDN to specify where a user will get created?
>> sss_useradd userName at otherDomain
>
> You can but if you are not using fully qualified names at the backend
> level (see the FQDN option) it is kind of useless as the system will
> only get back one user given a name from the first backend.
> If a domain uses fully qualified names the only way to get a user out is
> by using the fully qualified name.
I wondered if that would be the case. I'd only partially tested it.
>
>> Does this work for sss_groupadd?
>
> No sss_tools work only against the local provider and it doesn't make
> sense (and is not supported) to have more than one local provider.
"clink" (that was a penny dropping)
I didn't think >1 local provider was on the cards, but beyond that...
sss_useradd <user> adds <user> to LOCAL
ipa user-add <user> adds <user> to the ldap back end that IPA is using
ldapadd... if you just have an ldap back end set up
I dare say there are more options, depending on what environment you're
working in.
>
>> The closest I could get to this was the "re_expression (string)" entry
>> in the sssd.conf man page.
>
> Don't touch that one :-)
I was hoping I wouldn't have to :D
/dob
>
> Simo.
>
--
David O'Brien
Red Hat Asia Pacific
+61 7 3514 8189
http://freeipa.org/page/DocumentationPortal
http://git.fedorahosted.org/git/ipadocs.git
"The most valuable of all talents is that of never using two words when
one will do."
Thomas Jefferson
More information about the sssd-devel
mailing list