[SSSD] [PATCH] Add new option default_domain_suffix

Stephen Gallagher sgallagh at redhat.com
Tue Oct 2 11:45:03 UTC 2012


On Mon 01 Oct 2012 03:47:32 PM EDT, Jakub Hrozek wrote:
> On Mon, Oct 01, 2012 at 06:16:31PM +0200, Jakub Hrozek wrote:
>> On Mon, Oct 01, 2012 at 10:00:35AM +0200, Sumit Bose wrote:
>>> Hi,
>>>
>>> this patch fixes https://fedorahosted.org/sssd/ticket/1529 by adding a
>>> new global option default_domain_suffix which is used as a domain name
>>> for unqualified user names if set.
>>>
>>> As an expected side effect user names for the local domain must be fully
>>> qualified. This is breaking samba because samba first looks for the
>>> unqualified user name and then for a user 'DOM\username' where DOM is
>>> the flat/NetBIOS domain name. Currently the flats names were only used
>>> for sub domains, but now are required for the local domain as well to
>>> make samba work. The second patch adds the needed changes. Please also
>>> not that this patch should fix the responder part for
>>> https://fedorahosted.org/sssd/ticket/1468 as well. The AD provider now
>>> only needs to store the flat name in the domain object of the cache as
>>> the IPA provider does to solve the ticket.
>>>
>>> The third patch is just a fix for a typo I found while testing the
>>> second patch.
>>>
>>> bye,
>>> Sumit
>>
>> Patch 1/3 - Ack, I just found some typos in the manpage, I will fix them
>> before pushing, there's no need to waste devel time on respinning the
>> patch.
>>
>> Patch 2/3 - Ack
>> Patch 3/3 - Ack
>
> Pushed to master with this diff squashed in:
>
> diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
> index 0fec5a9..6fbbd9a 100644
> --- a/src/man/sssd.conf.5.xml
> +++ b/src/man/sssd.conf.5.xml
> @@ -222,14 +222,14 @@
>                                   name for all names without a domain name
>                                   component. The main use case are environments
>                                   were the local domain is only managing hosts
> -                                but no users and all user are coming from a
> +                                but no users and all users are coming from a
>                                   trusted domain. The option allows those users
>                                   to log in just with their user name without
>                                   giving a domain name as well.
>                               </para>
>                               <para>
>                                   Please note that if this option is set all
> -                                users from the local domain have to user their
> +                                users from the local domain have to use their
>                                   fully qualified name, e.g. user at domain.name,
>                                   to log in.
>                               </para>
>

Sorry for the late review.

Could we please ask Deon to review our manpages before clamping down on 
string freeze for 1.9.1? For example, the above doesn't read well in 
English:

"The main use case are environments were the local domain is only 
managing hosts but no users and all users are coming from a trusted 
domain."
would read better as:
"The main use case is environments where the primary domain is intended 
for managing host policies and all users are located in a trusted 
domain."

Also, any mention of "local domain" in this block is incorrect. It 
should be "primary domain" instead, or perhaps "directly-connected 
domain".


Deon, the manpages we released for 1.9.0 are all readable in HTML 
format at http://jhrozek.fedorapeople.org/sssd/1.9.0/man/ and I'm sure 
that Jakub can provide you with the updated versions pending for 1.9.1 
if you ask him nicely :)



More information about the sssd-devel mailing list