[SSSD] Authenticating users who exist in multiple domains

Simo Sorce simo at redhat.com
Sat Jul 23 20:00:26 UTC 2011


On Thu, 2011-07-21 at 18:51 -0400, Michael Fenn wrote:
> Greetings,
> 
> We're currently in the process of evaluating RHEL6 and as part of that 
> process, we're investigating using SSSD in our environment.  In the 
> process, we've hit a little snag when it comes to authenticating users 
> who exist in multiple domains.
> 
> First, a little background.  We have two groups of users, each 
> authenticating against a different Kerberos domain.  However, both users 
> exist in the same LDAP directory.  As such, I've set up SSSD with two 
> domains, both with the same LDAP directory provider but with different 
> Kerberos authentication providers. Let's call them A and B.  The domains 
> key in my sssd.conf is set to A,B .
> 
> If a user X in domain A attempts to authenticate either as X or X at A, 
> everything works as expected.  Similarly, if a user Y in domain B 
> attempts to authenticate as Y at B, everything works.  However, if Y is not 
> able to authenticate as simply Y .
> 
> In essence, it seems that if authentication fails for the first domain, 
> then SSSD will not attempt to authenticate the user against any other 
> domains.  For us, this represents a regression from the old way of doing 
> things, i.e. pam_krb5, where such failover was possible.  Are there any 
> plans to change this behavior in SSSD?

No, this is done by design. Each domain in SSSD represent a separate
identity domain and sharing user names between domains is not allowed.

Your problem is that by using the same LDAP server any user name you try
to use is found in the first domain A, and so SSSD stops parsing right
there, as it found the identity domain the user belongs to.

The only way to get around this is to use the Fully qualified name (Y at B)
which allows SSSD to understand you are actually looking at a separate
identity domain.

If you have really no overlaps between user names in the 2 realms, you
may be able to still use unqualified names if the 2 groups have
different uid ranges. In this case you can set the min_id and max_id
ranges in each domain to limit which users are visibile to each domain.
But keep in mind that this limits GIDs too. So groups also have to be
placed in the same range for each of the 2 domains.


Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list