[SSSD] Group results.

Sumit Bose sbose at redhat.com
Fri Dec 10 11:38:25 UTC 2010


On Fri, Dec 10, 2010 at 12:32:28PM +0100, Patrik Martinsson wrote:
> Hello,
> 
> I've almost managed to get sssd to work as I want, however I have this 
> problems with groupmembers.
> 
> If I do an ldapsearch on a group I get this result,
> 
> ---------
> member: CN=x1,OU=People,DC=x,DC=x,DC=x
> member: CN=x2,OU=People2,OU=People,DC=x,DC=x,DC=x
> member: CN=x3,OU=People,DC=x,DC=x,DC=x
> member: CN=x4,OU=People,DC=x,DC=x,DC=x
> member: CN=x5,OU=People,DC=x,DC=x,DC=x
> 
> memberUid: x1
> memberUid: x2
> memberUid: x5
> memberUid: x7
> memberUid: x8
> memberUid: x9
> ---------
> 
> A college told me that the difference (between members in 'member' and 
> 'memberUid') is because 'member' is the attribute set up for windows 
> accounts, and 'memberUid' is for the unixaccounts, and although these 
> often should be synced it could be some cases where its not (in our 
> setup anyway).
> 
> So what I want is getting sssd to map groupmembers to the memberUid.
> 
> Here's a snippet from my sssd.conf
> 
> ---------
> ldap_user_object_class     = User
> ldap_user_name                     = sAMAccountName
> ldap_user_uid_number         = uidNumber
> ldap_user_gid_number         = gidNumber
> ldap_user_shell                 = loginShell
> ldap_user_gecos                 = mail
> ldap_user_principal         = userPrincipalName
> ldap_user_member_of         = memberOf
> ldap_user_home_directory = msSFUHomeDirectory
> 
> ldap_group_object_class = Group
> ldap_group_name                 = cn
> ldap_group_gid_number     = gidNumber
> ldap_group_member                = memberuid
> # ldap_group_member                = member
> # ldap_group_member                = memberUid
> # ldap_group_uuid                    = memberUid
> ---------
> 
> I've tried different setups here but I cant really seem to figure it 
> out. If I run with the above settings i get no groups for users, and the 
> following is printed in sssd debug,
> ---------
> [sysdb_search_entry_done] (6) Error : Entry not found!
> [sdap_fill_memberships] (7) member #60 (x): not found!
> ---------
> 
> If I use the member instead of memberuid/Uid the users are mapped to 
> groups from the 'member' attribute, which seems logical,  however that's 
> not what I want, as I said before, I want to map usergroups against the  
> memberUid.
> 
> I would appreciate any tips or recommendations around this matter.

IIRC you have to set

ldap_schema = rfc2307

if you want to use memberUid (a list of user names instead a list of DNs)

HTH

bye,
Sumit

> 
> Best regards,
> Patrik Martinsson, Sweden.
> 
> 
> 
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list