[SSSD] SSSD - Configuration w/ 2008 R2

Stephen Gallagher sgallagh at redhat.com
Wed May 11 12:14:52 UTC 2011


On Tue, 2011-05-10 at 21:34 -0700, Ben Kevan wrote:
> 
> Humm, the groups should be POSIX compliant, and currently contain only
> POSIX compliant users. They work find in the previous methods of nss
> mapping, but not with sssd.  
> 
> 
> Here's the portion where it looks for my group memberships: 
> (Tue May 10 21:17:48 2011) [sssd[be[default]]] [sdap_get_generic_send]
> (6): calling ldap_search_ext with
> [(&(memberuid=bkevan)(objectclass=group))][DC=Domain,DC=com].
> 
> 
> Later in the debug logs I see: 
> (Tue May 10 21:17:51 2011) [sssd[be[default]]] [sdap_save_user_send]
> (7): Original memberOf is not available for [bkevan].
> (Tue May 10 21:17:51 2011) [sssd[be[default]]] [sdap_save_user_send]
> (7): User principal is not available for [bkevan].
> 

You should ignore those. They're informational, not errors. If those
attributes are available, we can do a few extra things.

> 
> So what should those be set to? ldapsearch doesn't show anything for
> memberuid, and if I change that to uid, it still complains. What in
> the output of ldapsearch should I be querying against to get a
> successful group membership listing from 2008 R2 AD? 


Your problem is that Active Directory is an RFC2307bis-compliant server,
rather than RFC2307. It uses the 'member' attribute (which is a DN, not
just a username). You need to set 'ldap_schema = rfc2307bis' in your
sssd.conf.

nss_ldap used to work because it did double-duty (it checked for both
RFC2307 and RFC2307bis members at all times). This is planned for the
future in SSSD (https://fedorahosted.org/sssd/ticket/445), but right now
you have to select one or the other (defaulting to RFC2307 because it is
more common)


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110511/a8c51541/attachment.sig>


More information about the sssd-devel mailing list