[SSSD] uid with @(at) sign

Jakub Hrozek jhrozek at redhat.com
Tue Dec 6 09:36:25 UTC 2011


On Tue, Dec 06, 2011 at 09:05:07AM +0200, Stefan Lesicnik wrote:
> > 
> > On Mon, Dec 05, 2011 at 12:37:35PM +0100, Jan Zelený wrote:
> > > > Hi,
> > > > 
> > > > I'm hoping someone can help. I am using RHEL 6.1 and trying to
> > > > use sssd to
> > > > authenticate to our ldap server.
> > > > 
> > > > Our ldap server uses the uid=name at domain as the uid. sssd seems
> > > > to pass the
> > > > name part only. Below is the extract from log. This is generated
> > > > by
> > > > running getent passwd stefan at lsd.com
> > > > 
> > > > Originally I had the issue where the @ part of the search was
> > > > looking for a
> > > > specific sssd provider. I changed my domain to lsd.com. This lets
> > > > me
> > > > search but as you can see below, passes the filter of uid=stefan
> > > > and not
> > > > uid=stefan at lsd.com
> > > > 
> > > > Thanks in advance,
> > > > Stefan
> > > 
> > > Hi Stefan,
> > > as I suggested to you on our IRC channel, I still think you should
> > > try setting
> > > re_expression in the config file so it doesn't translate the part
> > > after @ to a
> > > domain name. This is what it could look like (not sure though, I
> > > don't have a
> > > setup which I can test this on):
> > > 
> > > (?P<name>+$)
> > > 
> > > 
> > > Please try that and let us know.
> > > 
> > > Jan
> > 
> > You can just fine-tune the re_expression so it uses a different
> > character for name-domain delimeter. This would use the "~" sign:
> > 
> > re_expression = (?P<name>[^~]+)~?(?P<domain>[^~]*$)
> 
> Thanks Jan, Jakub
> 
> I got it working by changing the re_expression as above. I guess this would be a common request and this above re would be good in the manual somewhere.

The parameter is documented in sssd.conf(5) manual page. Do you feel
that an example of a custom regex would be prudent?

> I also discovered I need SSL / TLS for auth, so now im fixing that.

Yes, SSSD will not send passwords over unencrypted connection. Don't
hesitate to ask if you run into trouble.




More information about the sssd-devel mailing list