[SSSD] ldap_result found nothing!

Stephen Gallagher sgallagh at redhat.com
Thu Jul 29 11:32:02 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/29/2010 07:17 AM, Patrik Martinsson wrote:
> --------------
> [domain/FOO]
> description = LDAP domain with AD server
> enumerate = false
> min_id = 1000
> id_provider = ldap
> auth_provider = ldap
> ldap_uri = ldaps://foo.bar:636
> ldap_schema = rfc2307bis
> ldap_default_bind_dn = cn=xx,ou=People,dc=xx,dc=xx,dc=xx
> ldap_default_authtok_type = password
> ldap_default_authtok = xx
> ldap_search_base = DC=xx,DC=xx,DC=xx
> ldap_user_search_scope = sub
> ldap_user_search_base = ou=People,dc=xx,dc=xx,dc=xx
> ldap_group_search_base = ou=Groups,dc=xx,dc=xx,dc=xx
> ldap_user_object_class = person
> ldap_user_name = cn
> ldap_user_uid_number = msSFU30UidNumber
> ldap_user_gid_number = msSFU30GidNumber
> ldap_user_home_directory = msSFU30HomeDirectory
> ldap_user_shell = msSFU30LoginShell
> ldap_user_principal = userPrincipalName
> ldap_group_object_class = group
> ldap_group_name = posixGroup
> ldap_group_gid_number = msSFU30GidNumber
> ldap_force_upper_case_realm = True
> ldap_tls_reqcert = demand
> ldap_tls_cacert = /etc/openldap/cacerts/CADOUBLE.cer
> ldap_tls_cacertdir = /etc/openldap/cacerts
> --------------
> Here's how a working ldapsearch looks like,
> ldapsearch -x -L -Hldaps://foo.bar/ -D 
> 'cn=xxbind,ou=People,dc=xx,dc=xx,dc=xx' -w xxbindpwd -b 
> 'dc=xx,dc=xx,dc=xx' '(&(cn=xx)(objectclass=person))' cn uid
> This returns, as expected cn/uid for the requested user.
> 

Can you check an ldapsearch for whether msSFU30UidNumber actually
exists? First of all, in order to support UNIX/Linux clients, you need
to have Microsoft Services For Unix installed on the Active Directory
2003 or older server, or Subsystem for UNIX-based Applications installed
on Active Directory 2003R2 or newer.

Depending on which version of Active Directory you are running, the set
of attributes is different. For example, on AD 2003 (with SFU 3.5), the
attributes you set above will work.

However, for AD 2003R2 or AD 2008, there are a different set of
attributes which are fully RFC2307-compliant. This means that you can
just take the defaults for all attribute names in the SSSD and it should
work.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkxRZrIACgkQeiVVYja6o6NjXQCgmg5olskAgS5jEQp1KUMRqC07
KgoAniT4oZBTxUK8GcQYWBj1Ui1foXHw
=0jOx
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list