[SSSD] Need a strategy to manage AD group names for Unix consumption

Jan Zelený jzeleny at redhat.com
Tue Jan 31 12:13:14 UTC 2012


> > -----Original Message-----
> > From: sssd-devel-bounces at lists.fedorahosted.org [mailto:sssd-devel-
> > bounces at lists.fedorahosted.org] On Behalf Of Jakub Hrozek
> > Sent: Wednesday, 25 January 2012 7:10 PM
> > To: sssd-devel at lists.fedorahosted.org
> > Subject: Re: [SSSD] Need a strategy to manage AD group names for unix
> > consumption
> > 
> > On Wed, Jan 25, 2012 at 05:51:38PM +1100, Greg.Lehmann at csiro.au wrote:
> > >    We have many AD groups that don't have valid characters in them as
> > 
> > far as
> > 
> > >    Unix group names are concerned.
> > 
> > Can you give an example of an invalid name? SSSD only requires that the
> > names are valid UTF8.
> 
> Examples that cause us problems are the space and ampersand (&) characters
> in group names. Group name length can also be a problem.
> 
> > >    We'd like to use these AD groups in Unix
> > >    land without having to rename. In the past we have defined a
> > 
> > character
> > 
> > >    mapping to fix the invalid characters, so use an altered name in
> > 
> > Unix
> > 
> > >    land. The most important thing is the membership of the groups
> > 
> > which is
> > 
> > >    properly maintained in Windows land. I was hoping to use the same
> > >    character mapping and put the translated name into a spare
> > 
> > Attribute of
> > 
> > >    the AD group. The one that looks suitable is msSFU30Name but
> > 
> > trying this
> > 
> > >    does not seem to work.
> > 
> > Please note that group memberships in AD are determined by member DNs,
> > not just usernames.
> > 
> > >    I am testing by putting this line in my sssd.conf file
> > >    
> > >    
> > >    
> > >    ldap_group_name = msSFU30Name
> > 
> > In general yes, this is how you tell SSSD to look at non-default
> > attribute for the name.
> > 
> > >    For groups with this Attribute set, the id command shows the gid
> > >    (gidNumber set in AD) of the group but no group name. For those
> > 
> > groups
> > 
> > >    without a value in msSFU30Name I see the AD group name as well as
> > 
> > the gid.
> > 
> > >    For those groups with invalid characters in the name I see no
> > 
> > mention at
> > 
> > >    all in the id command output.
> 
> It does seem to be working, just that the id command can't cope. If I
> use the getent command that I saw somebody suggest in a previous note
> like this:
> 
> getent group msSFU30Namevalue
> 
> then I see what I would expect.

And what does id -G show you? Also, as Jakub already mentioned, some logs with 
debug_level = 7 and sanitized config would probably help a lot.

> 
> > >    I guess I have 2 questions - 1. Should this work?   2. If it won't
> > 
> > work
> > 
> > >    are there any other suggestions to solve the group name character
> > 
> > set
> > 
> > >    problem.
> > 
> > Posting a snippet of logs when SSSD is looking up a group as well would
> > certainly be helpful, as well as an example of invalid group name.

Thanks
Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120131/33c3dfae/attachment.sig>


More information about the sssd-devel mailing list