[SSSD] SSSD - Configuration w/ 2008 R2

Ben Kevan ben.kevan at gmail.com
Tue May 3 15:35:36 UTC 2011


On Tue, May 3, 2011 at 7:39 AM, Stephen Gallagher <sgallagh at redhat.com>wrote:

> On Tue, 2011-05-03 at 06:51 -0700, Ben Kevan wrote:
> > On Tue, May 3, 2011 at 4:47 AM, Stephen Gallagher
> > <sgallagh at redhat.com> wrote:
> >         On Mon, 2011-05-02 at 21:56 -0700, Ben Kevan wrote:
> >         > I'm wondering what the heck I'm doing wrong. I'm working on
> >         getting
> >         > SSSD + KRB5 working against 2008 R2 AD. It's working fine in
> >         RHEL5 w/
> >         > the standard LDAP.conf configuration. I'm working on sssd,
> >         but am not
> >         > getting a binddn connection to AD. Here's my config:
> >
> >         ...
> >         > ldap_default_bind_dn = ldapbinddn at DOMAIN.COM
> >
> >
> >         This is not a DN. This is a username. It's not the same thing.
> >         You need
> >         to figure out ldapbinddn's full distinguished name in LDAP and
> >         use that.
> >
> >
> >
> >
> > This wasn't the issue. You're able to use both the full DN, or the
> > shortened target method. It may not be documented, but if you're able
> > to traverse AD anonymously, then you'l ll be successful in the method
> > above. This is how I configured LDAP.con in RHEL5 even though it
> > requested the usage of a full DN.
>
> That sounds like a non-standard extension, and I'd really advise against
> relying on it. I won't guarantee that we won't parse for a valid DN and
> reject it as an option (it may work right now, but I might call that a
> bug rather than a feature).
>
> >
> >
> >         > wtf am I doing wrong, and is ldap for authentication better
> >         then
> >         > krb5? or should I stick with ldap for authorization and krb5
> >         for
> >         > authentication?
> >
> >
> >         Using krb5 for authentication allows you to acquire a
> >         single-sign-on TGT
> >         for use with other applications, so it's probably the
> >         preferred method
> >         in your case.
> >
> >
> > The issue was the ldap_uri, where I had both targets space delimited
> > and not comma delimited.
> >
>
> Ah, yes. That's caused problems for people before as well.
>
> >
> > However, I'm still having an issue with the results from getent passwd
> > <user>. Right now it's pulling / as homeDirectory, where homeDirectory
> > should report as /home/<user>. What mapping should this be on a 2008
> > R2 domain?
> >
>
> I'm guessing that ActiveDirectory isn't storing the homedir as the
> "homeDirectory" attribute by default. You'll have to look up what it
> should be in Windows Server 2008 R2, but at least on older systems the
> attribute would have been msSFU30HomeDirectory
>
> So you'd set
> ldap_user_home_directory = msSFU30HomeDirectory
> in the sssd.conf
>
> >
> > Also, pulling a getent group <groupname> I'm not egtting the correct
> > list of members as it is in AD (in the pure ad group and not in the
> > msSFU30 portion)
>
> You shouldn't be. You should only see the list of POSIX-compliant
> members. If the user or group members don't have POSIX attributes, we
> ignore them, since they aren't (and cannot be) relevant.
>

Doing an ldap search of a group I get the following for members (without the
antiquated methods of mapping msSFU30*)
member: CN=Unix bpm,OU=Service
Accounts,OU=Users,OU=Corporate,,DC=Domain,DC=com
member: CN=Ben Kevan,OU=Standard
Users,OU=Users,OU=Corporate,,DC=Domain,DC=com
distinguishedName: CN=NorCal Linux Admins,OU=Groups,DC=Domain,DC=com

Is there a way I can see what is being linked by default in sssd? Here's
what I had in previous versions of ldap.conf for mapping, maybe that'll help
map what they should be in SSSD easier.

nss_map_objectclass     posixAccount       User
nss_map_objectclass     shadowAccount      User
nss_map_objectclass     posixGroup         group

nss_map_attribute       uid                sAMAccountName
nss_map_attribute       uidNumber          uidNumber
nss_map_attribute       gidNumber          gidNumber
nss_map_attribute       uniqueMember       member
nss_map_attribute       givenname          givenName
nss_map_attribute       ou                 description
nss_map_attribute       gecos              displayName
nss_map_attribute       homeDirectory      unixHomeDirectory
nss_map_attribute       loginShell         loginShell
nss_map_attribute       shadowLastChange   pwdLastSet

nss_base_passwd DC=Domain,DC=com?sub
nss_base_shadow DC=Domain,DC=com?sub
nss_base_group DC=Domain,DC=com?sub?&(objectCategory=group)(gidNumber=*)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110503/bff46558/attachment.html>


More information about the sssd-devel mailing list