[SSSD] Group results.
Sumit Bose
sbose at redhat.com
Fri Dec 10 11:38:25 UTC 2010
On Fri, Dec 10, 2010 at 12:32:28PM +0100, Patrik Martinsson wrote:
> Hello,
>
> I've almost managed to get sssd to work as I want, however I have this
> problems with groupmembers.
>
> If I do an ldapsearch on a group I get this result,
>
> ---------
> member: CN=x1,OU=People,DC=x,DC=x,DC=x
> member: CN=x2,OU=People2,OU=People,DC=x,DC=x,DC=x
> member: CN=x3,OU=People,DC=x,DC=x,DC=x
> member: CN=x4,OU=People,DC=x,DC=x,DC=x
> member: CN=x5,OU=People,DC=x,DC=x,DC=x
>
> memberUid: x1
> memberUid: x2
> memberUid: x5
> memberUid: x7
> memberUid: x8
> memberUid: x9
> ---------
>
> A college told me that the difference (between members in 'member' and
> 'memberUid') is because 'member' is the attribute set up for windows
> accounts, and 'memberUid' is for the unixaccounts, and although these
> often should be synced it could be some cases where its not (in our
> setup anyway).
>
> So what I want is getting sssd to map groupmembers to the memberUid.
>
> Here's a snippet from my sssd.conf
>
> ---------
> ldap_user_object_class = User
> ldap_user_name = sAMAccountName
> ldap_user_uid_number = uidNumber
> ldap_user_gid_number = gidNumber
> ldap_user_shell = loginShell
> ldap_user_gecos = mail
> ldap_user_principal = userPrincipalName
> ldap_user_member_of = memberOf
> ldap_user_home_directory = msSFUHomeDirectory
>
> ldap_group_object_class = Group
> ldap_group_name = cn
> ldap_group_gid_number = gidNumber
> ldap_group_member = memberuid
> # ldap_group_member = member
> # ldap_group_member = memberUid
> # ldap_group_uuid = memberUid
> ---------
>
> I've tried different setups here but I cant really seem to figure it
> out. If I run with the above settings i get no groups for users, and the
> following is printed in sssd debug,
> ---------
> [sysdb_search_entry_done] (6) Error : Entry not found!
> [sdap_fill_memberships] (7) member #60 (x): not found!
> ---------
>
> If I use the member instead of memberuid/Uid the users are mapped to
> groups from the 'member' attribute, which seems logical, however that's
> not what I want, as I said before, I want to map usergroups against the
> memberUid.
>
> I would appreciate any tips or recommendations around this matter.
IIRC you have to set
ldap_schema = rfc2307
if you want to use memberUid (a list of user names instead a list of DNs)
HTH
bye,
Sumit
>
> Best regards,
> Patrik Martinsson, Sweden.
>
>
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
More information about the sssd-devel
mailing list