[SSSD] [PATCH] LDAP: Add AD 2008r2 schema

Stephen Gallagher sgallagh at redhat.com
Wed Mar 14 17:53:54 UTC 2012


On Wed, 2012-03-14 at 10:42 +0100, Jan Zelený wrote:
> > On Tue, 2012-03-13 at 16:21 +0100, Jan Zelený wrote:
> > > > Fixes https://fedorahosted.org/sssd/ticket/1031
> > > > 
> > > > This patch creates a set of schema defaults that corresponds to Active
> > > > Directory 2008r2. It can be set up simply by specifying
> > > > ldap_schema = AD
> > > > 
> > > > Operationally, it behaves like any other RFC2307bis server at this
> > > > time. This patch does not remove the requirement for SFU/SUA support
> > > > in Active Directory. More enhancements will follow to add support for
> > > > AD-specific features.
> > > 
> > > I have couple questions/notes based on observation of values on my
> > > testing AD instance:
> > > 
> > > Attribute gecos is apparently not filled by default, wouldn't it be
> > > better to use cn?
> > 
> > This is actually the same behavior as on other LDAP servers. The
> > expectation is that the GECOS field should be used if it's not empty,
> > otherwise it should default to the user's full name. In the SSSD, we
> > first check for the 'gecos' attribute and then go to ldap_user_fullname
> > (which in the case of RFC 2307 would be "cn", but in AD is "name").
> > 
> > > I didn't find attribute authorizedService in the AD attribute
> > > specification, is it correct?
> > 
> > Hmm, I was actually inconsistent here. I was leaving this in for the
> > rare case where an AD admin decided to extend schema to support this.
> > However, I made the opposite decision about ldap_user_authorized_host.
> > 
> > Probably it's acceptable to set this to NULL and rely on the admin to
> > change it if they end up extending the schema. Fixed in attached patch.
> 
> Ack


Pushed to master.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120314/3033157c/attachment.sig>


More information about the sssd-devel mailing list