[SSSD] Help with AD 2003 (with SFU) and groups

Chris Bridson (TOC) Chris.Bridson at bbsrc.ac.uk
Tue Dec 7 13:18:28 UTC 2010


Hi all,
I wonder if it's possible to get a little help/debugging with the config of my sssd.conf for nested group membership.

We're using LDAP (provided via an AD 2003 forest and the SFU schema) and Kerberos. It works fine with nss_ldap on RHEL and returns all groups a user is a memberOf.

The following msSFU attributes are used (although not populated for all users and groups):
#Users
msSFU30UidNumber
msSFU30GidNumber
msSFU30HomeDirectory
msSFU30LoginShell

#Group
msSFU30GidNumber

Our sssd.conf (sanitised) is the following:

[domain/default]
description = LDAP domain with AD server

id_provider = ldap
auth_provider = krb5
hpass_provider = krb5
cache_credentials = True

ldap_schema = rfc2307
ldap_id_use_start_tls = False
ldap_uri = ldap://SUB.DOMAIN.COM/
ldap_search_base = dc=SUB,dc=DOMAIN,dc=COM

ldap_default_bind_dn = BINDUSER at SUB
ldap_default_authtok_type = password
ldap_default_authtok = PASSWORD

ldap_user_object_class = user
ldap_user_search_base = OU=SITEUsers,DC=SUB,DC=DOMAIN,DC=COM
ldap_user_name = sAMAccountName
ldap_user_uid_number = msSFU30UidNumber
ldap_user_gid_number = msSFU30GidNumber
ldap_user_home_directory = msSFU30HomeDirectory
ldap_user_shell = msSFU30LoginShell
ldap_user_fullname = displayName
ldap_user_gecos = displayName
ldap_user_member_of = memberOf

ldap_group_search_base = OU=SITEGroups,DC=SUB,DC=DOMAIN,DC=COM
ldap_group_object_class = group
ldap_group_name = cn
ldap_group_gid_number = msSFU30GidNumber

ldap_force_upper_case_realm = True

ldap_tls_cacertdir = /etc/openldap/cacerts

krb5_kpasswd = DC1.SUB.DOMAIN.COM:749
krb5_realm = SUB.DOMAIN.COM
krb5_kdcip = DC1.SUB.DOMAIN.COM:88

debug_level=6

The  ldap_schema is set at rfc2307 since rfc2307bis does not appear to work at all when calling:
                getent group GROUP_NAME     ---- Returns blank
                getent passwd USER_NAME       ---- Returns all user attributes and the group entry (GID) msSFU30GidNumber but no group name

Setting ldap_group_member = member breaks the group name being looked up also on rfc2307 . A minimal configuration doesn't appear to help either.

I've attached 4  debug6 files (sanitised).
Two for rfc2307 and two for rfc2307bis - with and without the ldap_group_member being specified.
The Linux command ran was:
                id THE_USER
I would have expected it to output two groups cbu (2004) and comp (2000) for THE_USER.

If anyone could shed some light onto why the specification of ldap_group_member is a problem and why nested groups aren't working what I need to do to make it do that'd be fantastic.
Thanks,

Chris.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20101207/0ab44f4d/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sssd_default.log-rfc2307-nomember
Type: application/octet-stream
Size: 19986 bytes
Desc: sssd_default.log-rfc2307-nomember
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20101207/0ab44f4d/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sssd_default.log-rfc2307-withmember
Type: application/octet-stream
Size: 22486 bytes
Desc: sssd_default.log-rfc2307-withmember
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20101207/0ab44f4d/attachment-0001.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sssd_default.log-rfc2307bis-nomember
Type: application/octet-stream
Size: 32034 bytes
Desc: sssd_default.log-rfc2307bis-nomember
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20101207/0ab44f4d/attachment-0002.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sssd_default.log-rfc2307bis-withmember
Type: application/octet-stream
Size: 32034 bytes
Desc: sssd_default.log-rfc2307bis-withmember
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20101207/0ab44f4d/attachment-0003.obj>


More information about the sssd-devel mailing list