[SSSD] [PATCH] LDAP: Add AD 2008r2 schema

Stephen Gallagher sgallagh at redhat.com
Tue Mar 13 15:46:15 UTC 2012


On Tue, 2012-03-13 at 16:21 +0100, Jan Zelený wrote:
> > Fixes https://fedorahosted.org/sssd/ticket/1031
> > 
> > This patch creates a set of schema defaults that corresponds to Active
> > Directory 2008r2. It can be set up simply by specifying
> > ldap_schema = AD
> > 
> > Operationally, it behaves like any other RFC2307bis server at this time.
> > This patch does not remove the requirement for SFU/SUA support in Active
> > Directory. More enhancements will follow to add support for AD-specific
> > features.
> 
> I have couple questions/notes based on observation of values on my testing AD 
> instance:
> 
> Attribute gecos is apparently not filled by default, wouldn't it be better to 
> use cn?

This is actually the same behavior as on other LDAP servers. The
expectation is that the GECOS field should be used if it's not empty,
otherwise it should default to the user's full name. In the SSSD, we
first check for the 'gecos' attribute and then go to ldap_user_fullname
(which in the case of RFC 2307 would be "cn", but in AD is "name").

> I didn't find attribute authorizedService in the AD attribute specification, is 
> it correct?

Hmm, I was actually inconsistent here. I was leaving this in for the
rare case where an AD admin decided to extend schema to support this.
However, I made the opposite decision about ldap_user_authorized_host.

Probably it's acceptable to set this to NULL and rely on the admin to
change it if they end up extending the schema. Fixed in attached patch.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-LDAP-Add-AD-2008r2-schema.patch
Type: text/x-patch
Size: 5977 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120313/53ddfc0e/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120313/53ddfc0e/attachment.sig>


More information about the sssd-devel mailing list