[SSSD] How to map primaryGID? was "Re: [PATCHES][PRELIMINARY] Add support for Active Directory objectSID mappings"
Simo Sorce
simo at redhat.com
Sun Apr 22 21:27:51 UTC 2012
On Sun, 2012-04-22 at 15:10 -0400, Stephen Gallagher wrote:
> Ok, I just hit a snag and I'm not sure how best to proceed. All users on
> a POSIX system need to have a default GID value, which in most cases is
> mapped to a user-private group to help avoid accidental permission-leaks
> when that user creates files.
>
> However, when mapping a user from Active Directory's objectSID, we don't
> have an obvious group to which we can map the primaryGID. I'm not sure
> how best to proceed here.
Why can't you use the Primary-Group-ID attribute ?
> One option is to map users' primaryGID to the special group "Domain
> Users" to which all AD users belong, but that runs the risk of
> reintroducing the above-mentioned permission leaks. I don't really have
> any other ideas here, though. Recommendations welcome.
I think a good idea would also be to fake up a primary group that has
the same name as the user and same numerical id. This would be the best
mapping, I wish we had done that in samba many years ago.
However you may need to make that conditional and go back to use the
Primary-Group-ID if you want to interoperate with samba as samba will
take the primary group SID and reverse map that to a gid for the user.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list