[SSSD] fun with fc13, ldaps, uids

Stephen Gallagher sgallagh at redhat.com
Wed May 26 15:18:22 UTC 2010


On 05/26/2010 11:12 AM, Bobby Krupczak wrote:
> Hi!
>
> (I subscribed to the list but am not receiving the email yet.  I'm
> reading replies via the archive.)

Check your junk mail folder. The confirmation email for joining the 
group may have gotten filtered out (or you might have mistyped your address)

>
>> I'm guessing rdk has a UID<  1000. This is generally a bad idea for
>> network accounts, as they're vulnerable to colliding with local
>> accounts. It sounds like in your case you actually have control over
>> the UID range, so it might be possible for you to change the UID.
>

>> Otherwise, change the min_id setting in sssd.conf to something more
>> appropriate for your environment. (We have that there to try to
>> protect against network vs. local ID conflicts)
>
> [root at columbia openldap]# id rdk
> uid=6169(rdk) gid=100(users) groups=100(users),109(slide),110(www)
>
> My account is old as the hills and so I've kept my uid.  I agree that
> standardized numbering ranges is a very good thing.
>

I was close: the problem is your group range, not the userid. Your group 
"users" is 100.  You probably want to set min_id=100. This has the same 
problem as having users in groups much too low. It will conflict with 
system groups in /etc/group

> What are the defaults for sssd for uid ranges?  I see were the options
> can be set but dont know what msSFU30UidNumber is.
>
> # ldap_user_uid_number = msSFU30UidNumber
> # ldap_user_gid_number = msSFU30GidNumber
>

Those are irrelevant to your current situation. That's where you can 
change the name of the attribute that is used to look up the UID number 
or GID number. The defaults are fine in your configuration.

If you do 'man sssd.conf' you'll see the min_id and max_id options. 
These are what you need. They define the range of users that SSSD will see.

> Thanks,
>
> Bobby
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel


-- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/



More information about the sssd-devel mailing list