[SSSD] Help with AD 2003 (with SFU) and groups

Chris Bridson (TOC) Chris.Bridson at bbsrc.ac.uk
Wed Dec 8 08:35:03 UTC 2010


Hi Stephen,
Thanks for letting me know, I'd tried with 1.4.1 but that too had the same problem.
I'll do a checkout on the latest source to make sure it’s all working, and then file a bug report with RHEL since it's quite important for AD integration and offers numerous benefits over plain old LDAP/Kerberos.
Thanks again for your help,

Chris.

-----Original Message-----
From: Stephen Gallagher [mailto:sgallagh at redhat.com] 
Sent: 07 December 2010 15:49
To: Development of the System Security Services Daemon
Cc: Chris Bridson (TOC)
Subject: Re: [SSSD] Help with AD 2003 (with SFU) and groups

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/07/2010 08:18 AM, Chris Bridson (TOC) wrote:
> Hi all,
> 
> I wonder if it's possible to get a little help/debugging with the config
> of my sssd.conf for nested group membership.
> 
>  
> 
> We're using LDAP (provided via an AD 2003 forest and the SFU schema) and
> Kerberos. It works fine with nss_ldap on RHEL and returns all groups a
> user is a memberOf.
>

AD 2003+SFU should be using ldap_schema = rfc2307bis and leaving
ldap_group_member at the default (which is member).

However, there's a problem. You're hitting bug
https://fedorahosted.org/sssd/ticket/458 because your groups have
parentheses in the name. In SSSD 1.2.x (which is what is currently in
RHEL) we weren't properly excaping the search filters for users and
groups, so we're getting an internal error that the filter can't be
parsed, because it's not a valid LDAP search filter.

This is fixed upstream in SSSD 1.5.0, which is scheduled for inclusion
in Fedora 15 and in upcoming RHEL releases. If you need this fix
backported to 1.2.x for a currently-supported RHEL release, please open
a bug at http://bugzilla.redhat.com against SSSD in the appropriate
release and it will be evaluated for an earlier errata.


- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkz+V2UACgkQeiVVYja6o6NoJwCfcNSpPjkO2xRDmmAisUjHvhhw
dtYAnRHCMd1bAK1iqja160B0c4ByBK5m
=uARS
-----END PGP SIGNATURE-----


More information about the sssd-devel mailing list