[SSSD] Need a strategy to manage AD group names for unix consumption
Jakub Hrozek
jhrozek at redhat.com
Wed Jan 25 09:09:47 UTC 2012
On Wed, Jan 25, 2012 at 05:51:38PM +1100, Greg.Lehmann at csiro.au wrote:
> We have many AD groups that don't have valid characters in them as far as
> Unix group names are concerned.
Can you give an example of an invalid name? SSSD only requires that the
names are valid UTF8.
> We'd like to use these AD groups in Unix
> land without having to rename. In the past we have defined a character
> mapping to fix the invalid characters, so use an altered name in Unix
> land. The most important thing is the membership of the groups which is
> properly maintained in Windows land. I was hoping to use the same
> character mapping and put the translated name into a spare Attribute of
> the AD group. The one that looks suitable is msSFU30Name but trying this
> does not seem to work.
>
Please note that group memberships in AD are determined by member DNs,
not just usernames.
>
>
> I am testing by putting this line in my sssd.conf file
>
>
>
> ldap_group_name = msSFU30Name
In general yes, this is how you tell SSSD to look at non-default
attribute for the name.
>
>
>
> For groups with this Attribute set, the id command shows the gid
> (gidNumber set in AD) of the group but no group name. For those groups
> without a value in msSFU30Name I see the AD group name as well as the gid.
> For those groups with invalid characters in the name I see no mention at
> all in the id command output.
>
>
>
> I guess I have 2 questions - 1. Should this work? 2. If it won't work
> are there any other suggestions to solve the group name character set
> problem.
>
>
>
Posting a snippet of logs when SSSD is looking up a group as well would
certainly be helpful, as well as an example of invalid group name.
More information about the sssd-devel
mailing list