[SSSD] [PATCHES] Add Active Directory identity, auth and chpass providers to SSSD

Stef Walter stefw at gnome.org
Mon Jul 2 16:18:18 UTC 2012


On 07/02/2012 06:02 PM, Simo Sorce wrote:
> 1.
> You should never allow to set a domain that differs from the realm name
> in the AD provider, it is always assumed realm = domain in AD.
> 
> In AD both the realm and the domain are case insensitive however MIT
> libs needs to use the Realm all upper case for compat reasons.
> 
> I think the best thing for now is to simply ignore KRB5_REALM (do not
> even define AD_KRB5_REALM) and just always user the upper cased domain
> for the realm variable unconditionally.

To support AD style logins like "DOMAIN\User" (where 'DOMAIN' is the
short domain or workgroup name) I've been configuring SSSD like this:

 [domain/DOMAIN]
 dns_discovery_domain = domain.example.com
 re_expression = (?P<domain>[^\\]+)\\(?P<name>[^\\]+)
 full_name_format = %2$s\\%1$s
 ... other settings ...

Is there another sane way to setup AD style logins? If not, then we
would need to continue to allow the sssd domain to differ from the AD realm.

Cheers,

Stef



More information about the sssd-devel mailing list