[SSSD] How to deal with multihomed machines [Re: [PATCHES] sudo failing for ad trusted user in IPA environment]
Simo Sorce
simo at redhat.com
Mon Nov 12 15:10:25 UTC 2012
On Mon, 2012-11-12 at 09:05 -0500, Dmitri Pal wrote:
I changed the subject because this is a separate discussion and not a
review of the patches.
> It is generally a good idea to be able to get SUDO rules from two
> different domains.
> Think about a setup when SSSD is configured with two domains say AD and
> IPA.
> Both can serve SUDO via LDAP (or via GPO when we add them for AD). Users
> from AD should use rules defined in AD while users in IPA should use
> rules from IPA.
Not if AD users come via a trust.
If you are thinking of multihomed systems that 'join' 2 domains, well,
that is a messy situation, it is debatable what is the right thing to
do.
> In this case we effectively have a machine that joins two different
> domains, this should be doable.
Debatable though, what domain 'owns' the security properties of the
machine ? 2 domains might have completely different and even conflicting
rules.
> BTW I wonder if one can actually make the system join AD and IPA domain
> at the same time and make one configuration not step on another.
> Is it possible now? I hope so. If not we should file a ticket to make it
> possible.
I am not sure, but I think it is not a desirable thing to document. It
carries way too many breaches of trust for both domains.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list