[SSSD] Authenticating users who exist in multiple domains

Michael Fenn mfenn at psu.edu
Thu Jul 21 22:51:08 UTC 2011


Greetings,

We're currently in the process of evaluating RHEL6 and as part of that 
process, we're investigating using SSSD in our environment.  In the 
process, we've hit a little snag when it comes to authenticating users 
who exist in multiple domains.

First, a little background.  We have two groups of users, each 
authenticating against a different Kerberos domain.  However, both users 
exist in the same LDAP directory.  As such, I've set up SSSD with two 
domains, both with the same LDAP directory provider but with different 
Kerberos authentication providers. Let's call them A and B.  The domains 
key in my sssd.conf is set to A,B .

If a user X in domain A attempts to authenticate either as X or X at A, 
everything works as expected.  Similarly, if a user Y in domain B 
attempts to authenticate as Y at B, everything works.  However, if Y is not 
able to authenticate as simply Y .

In essence, it seems that if authentication fails for the first domain, 
then SSSD will not attempt to authenticate the user against any other 
domains.  For us, this represents a regression from the old way of doing 
things, i.e. pam_krb5, where such failover was possible.  Are there any 
plans to change this behavior in SSSD?

Thanks,
Michael Fenn
Systems Administrator
Research Computing and Cyberinfrastructure
Penn State



More information about the sssd-devel mailing list