[SSSD] Authenticating users who exist in multiple domains
Michael Fenn
mfenn at psu.edu
Thu Jul 21 22:51:08 UTC 2011
Greetings,
We're currently in the process of evaluating RHEL6 and as part of that
process, we're investigating using SSSD in our environment. In the
process, we've hit a little snag when it comes to authenticating users
who exist in multiple domains.
First, a little background. We have two groups of users, each
authenticating against a different Kerberos domain. However, both users
exist in the same LDAP directory. As such, I've set up SSSD with two
domains, both with the same LDAP directory provider but with different
Kerberos authentication providers. Let's call them A and B. The domains
key in my sssd.conf is set to A,B .
If a user X in domain A attempts to authenticate either as X or X at A,
everything works as expected. Similarly, if a user Y in domain B
attempts to authenticate as Y at B, everything works. However, if Y is not
able to authenticate as simply Y .
In essence, it seems that if authentication fails for the first domain,
then SSSD will not attempt to authenticate the user against any other
domains. For us, this represents a regression from the old way of doing
things, i.e. pam_krb5, where such failover was possible. Are there any
plans to change this behavior in SSSD?
Thanks,
Michael Fenn
Systems Administrator
Research Computing and Cyberinfrastructure
Penn State
More information about the sssd-devel
mailing list