[SSSD] [PATCHES] Add Active Directory identity, auth and chpass providers to SSSD

Stephen Gallagher sgallagh at redhat.com
Tue Jul 3 15:31:08 UTC 2012


On Mon, 2012-07-02 at 21:02 +0200, Sumit Bose wrote:
> On Mon, Jul 02, 2012 at 12:52:42PM -0400, Simo Sorce wrote:
> > On Mon, 2012-07-02 at 18:18 +0200, Stef Walter wrote:
> > > On 07/02/2012 06:02 PM, Simo Sorce wrote:
> > > > 1.
> > > > You should never allow to set a domain that differs from the realm name
> > > > in the AD provider, it is always assumed realm = domain in AD.
> > > > 
> > > > In AD both the realm and the domain are case insensitive however MIT
> > > > libs needs to use the Realm all upper case for compat reasons.
> > > > 
> > > > I think the best thing for now is to simply ignore KRB5_REALM (do not
> > > > even define AD_KRB5_REALM) and just always user the upper cased domain
> > > > for the realm variable unconditionally.
> > > 
> > > To support AD style logins like "DOMAIN\User" (where 'DOMAIN' is the
> > > short domain or workgroup name) I've been configuring SSSD like this:
> > > 
> > >  [domain/DOMAIN]
> > >  dns_discovery_domain = domain.example.com
> > >  re_expression = (?P<domain>[^\\]+)\\(?P<name>[^\\]+)
> > >  full_name_format = %2$s\\%1$s
> > >  ... other settings ...
> > > 
> > > Is there another sane way to setup AD style logins? If not, then we
> > > would need to continue to allow the sssd domain to differ from the AD realm.
> > 
> > I think we need to fetch the netbios domain name from AD and allow to
> > use that instead of having to manually configure a regex.
> 
> I agree, the sub-domain code also reads the DNS domain name and the
> flat/NetBIOS name from the IPA server so the either name can be used to
> search for a domain.


Sumit, Simo: Would one or both of you mind opening an RFE upstream
describing what you want done here? I'm not completely sure I follow.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120703/b670ea1f/attachment.sig>


More information about the sssd-devel mailing list