[SSSD] How to deal with multihomed machines [Re: [PATCHES] sudo failing for ad trusted user in IPA environment]

Jakub Hrozek jhrozek at redhat.com
Tue Nov 13 12:13:36 UTC 2012


On Mon, Nov 12, 2012 at 10:10:25AM -0500, Simo Sorce wrote:
> On Mon, 2012-11-12 at 09:05 -0500, Dmitri Pal wrote:
> 
> I changed the subject because this is a separate discussion and not a
> review of the patches.
> 
> > It is generally a good idea to be able to get SUDO rules from two
> > different domains.
> > Think about a setup when SSSD is configured with two domains say AD and
> > IPA.
> > Both can serve SUDO via LDAP (or via GPO when we add them for AD). Users
> > from AD should use rules defined in AD while users in IPA should use
> > rules from IPA.
> 
> Not if AD users come via a trust.
> 
> If you are thinking of multihomed systems that 'join' 2 domains, well,
> that is a messy situation, it is debatable what is the right thing to
> do.
> 
> > In this case we effectively have a machine that joins two different
> > domains, this should be doable.
> 
> Debatable though, what domain 'owns' the security properties of the
> machine ? 2 domains might have completely different and even conflicting
> rules.
> 
> > BTW I wonder if one can actually make the system join AD and IPA domain
> > at the same time and make one configuration not step on another.
> > Is it possible now? I hope so. If not we should file a ticket to make it
> > possible.
> 
> I am not sure, but I think it is not a desirable thing to document. It
> carries way too many breaches of trust for both domains.
> 
> Simo.

I always thought of the SSSD being able to support multiple domains as a
very good thing - consider a devel and production servers in a company
or a client that is a member of both a home IPA server and a company
AD server..

Where do you see conflicts between domains?



More information about the sssd-devel mailing list