[SSSD] [patch] Make example sssd.conf a working example with a local domain

Dmitri Pal dpal at redhat.com
Thu May 27 21:18:29 UTC 2010


Petter Reinholdtsen wrote:
> At the moment, if sssd is given the example sssd.conf file, sssd
> reuses to start.  In Debian and Ubuntu, the example sssd.conf file is
> patched like this and installed in /etc/sssd/sssd.conf to make sure
> the sssd package get an operational daemon when the package is
> installed.
>
>   

I wonder what is the current behavior when there are no back ends
configured.
Having the local domain being the default IMO sends a wrong message.
I think if there are no domains configured the SSSD should return the
code that will instruct NSS to fail over to the next NSS module in the
chain.
Same with the PAM.

So instead of making SSSD be configured to use local domain by default
the solution IMO should be:
* Configure SSSD to use real domain (this is what SSSD is for)
* Configure PAM and NSS config files using legacy methods to take over
if SSSD indicates that it is not configured.

Thoughts?

> Any hope of having this patch included in the upstream tarball?
>
> diff -urNad l-new-upstream~/server/examples/sssd.conf l-new-upstream/server/examples/sssd.conf
> --- l-new-upstream~/src/examples/sssd.conf      2010-01-18 13:09:10.000000000 -0500
> +++ l-new-upstream/src/examples/sssd.conf       2010-01-18 13:18:18.000000000 -0500
> @@ -13,7 +13,7 @@
>  # Add new domain configurations as [domain/<NAME>] sections, and
>  # then add the list of domains (in the order you want them to be
>  # queried) to the "domains" attribute below and uncomment it.
> -; domains = LOCAL,LDAP
> +domains = LOCAL
>
>  [nss]
>  # The following prevents SSSD from searching for the root user/group in
> @@ -45,12 +45,12 @@
>  # Example LOCAL domain that stores all users natively in the SSSD internal
>  # directory. These local users and groups are not visible in /etc/passwd; it
>  # now contains only root and system accounts.
> -; [domain/LOCAL]
> -; description = LOCAL Users domain
> -; id_provider = local
> -; enumerate = true
> -; min_id = 500
> -; max_id = 999
> +[domain/LOCAL]
> +description = LOCAL Users domain
> +id_provider = local
> +enumerate = true
> +min_id = 500
> +max_id = 999
>
>  # Example native LDAP domain
>  # ldap_schema can be set to "rfc2307", which uses the "memberuid" attribute
>
> Happy hacking,
>   


-- 
Thank you,
Dmitri Pal

Engineering Manager IPA project,
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/




More information about the sssd-devel mailing list