[SSSD] Need a strategy to manage AD group names for unix consumption

Jakub Hrozek jhrozek at redhat.com
Wed Jan 25 09:09:47 UTC 2012


On Wed, Jan 25, 2012 at 05:51:38PM +1100, Greg.Lehmann at csiro.au wrote:
>    We have many AD groups that don't have valid characters in them as far as
>    Unix group names are concerned.

Can you give an example of an invalid name? SSSD only requires that the
names are valid UTF8.

>    We'd like to use these AD groups in Unix
>    land without having to rename. In the past we have defined a character
>    mapping to fix the invalid characters, so use an altered name in Unix
>    land. The most important thing is the membership of the groups which is
>    properly maintained in Windows land. I was hoping to use the same
>    character mapping and put the translated name into a spare Attribute of
>    the AD group. The one that looks suitable is msSFU30Name but trying this
>    does not seem to work.
> 

Please note that group memberships in AD are determined by member DNs,
not just usernames.

>     
> 
>    I am testing by putting this line in my sssd.conf file
> 
>     
> 
>    ldap_group_name = msSFU30Name

In general yes, this is how you tell SSSD to look at non-default
attribute for the name.

> 
>     
> 
>    For groups with this Attribute set, the id command shows the gid
>    (gidNumber set in AD) of the group but no group name. For those groups
>    without a value in msSFU30Name I see the AD group name as well as the gid.
>    For those groups with invalid characters in the name I see no mention at
>    all in the id command output.
> 
>     
> 
>    I guess I have 2 questions - 1. Should this work?   2. If it won't work
>    are there any other suggestions to solve the group name character set
>    problem.
> 
>     
> 

Posting a snippet of logs when SSSD is looking up a group as well would
certainly be helpful, as well as an example of invalid group name.



More information about the sssd-devel mailing list