[SSSD] How to map primaryGID? was "Re: [PATCHES][PRELIMINARY] Add support for Active Directory objectSID mappings"

Simo Sorce simo at redhat.com
Sun Apr 22 21:27:51 UTC 2012


On Sun, 2012-04-22 at 15:10 -0400, Stephen Gallagher wrote:
> Ok, I just hit a snag and I'm not sure how best to proceed. All users on
> a POSIX system need to have a default GID value, which in most cases is
> mapped to a user-private group to help avoid accidental permission-leaks
> when that user creates files.
> 
> However, when mapping a user from Active Directory's objectSID, we don't
> have an obvious group to which we can map the primaryGID. I'm not sure
> how best to proceed here.

Why can't you use the Primary-Group-ID attribute ?

> One option is to map users' primaryGID to the special group "Domain
> Users" to which all AD users belong, but that runs the risk of
> reintroducing the above-mentioned permission leaks. I don't really have
> any other ideas here, though. Recommendations welcome.

I think a good idea would also be to fake up a primary group that has
the same name as the user and same numerical id. This would be the best
mapping, I wish we had done that in samba many years ago.

However you may need to make that conditional and go back to use the
Primary-Group-ID if you want to interoperate with samba as samba will
take the primary group SID and reverse map that to a gid for the user.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list