[SSSD] Subdomains and access provider

Jakub Hrozek jhrozek at redhat.com
Mon Sep 9 12:49:43 UTC 2013


On Mon, Sep 09, 2013 at 08:35:32AM -0400, Dmitri Pal wrote:
> On 09/09/2013 04:28 AM, Jakub Hrozek wrote:
> > On Sun, Sep 08, 2013 at 09:13:46PM -0400, Dmitri Pal wrote:
> >> On 09/08/2013 06:07 PM, Jakub Hrozek wrote:
> >>> On Sat, Sep 07, 2013 at 07:26:51PM -0400, Dmitri Pal wrote:
> >>>> Hello,
> >>>>
> >>>> When one uses SSSD with AD provider but user comes from a subdomain
> >>>> there are implications for the access provider. AFAIU we have a ticket
> >>>> for simple access provider: https://fedorahosted.org/sssd/ticket/2034
> >>>> but what about other access providers? What are the implications? And
> >>>> what would be the best practices in configuring SSSD in this case? What
> >>>> access provider would we recommend?
> >>>>
> >>> Yes, I was thinking about these use cases after the recent sssd-users
> >>> thread. The exact use-case that was described is very common so I think
> >>> we should react.
> >>>
> >>> For the AD provider, I think we might add one more configuration option
> >>> "ad_access_filter" that, if set, would augment the AD access provider so
> >>> that it first checks if the account is expired and if it's not, then
> >>> proceed to check if the account matches the filter without having to
> >>> configure the LDAP provider.
> >>>
> >>>> I envision a wiki page titled: "HOWTO/Selecting the best access control
> >>>> configuration for the SSSD AD provider". That should cover different use
> >>>> cases and give recommendations based on the use case.
> >>> I agree. So I think we should open two tickets -- one for the
> >>> documentation and one for the option. Do you agree?
> >> Yes, and the one for option should start with a design page on wiki
> >> extracting information from this thread.
> > New option:
> > https://fedorahosted.org/sssd/ticket/2082
> >
> > Documentation:
> > https://fedorahosted.org/sssd/ticket/2083
> >
> > I also realized I didn't answer your original question about the other
> > access providers and how they relate to subdomains. I think the fact
> > that the subdomain access provider didn't work was quite a special case,
> > because the main problem was that in the SSSD, it's not really easy to
> > call a method of one provider (AD) from other provider (simple). If the
> > types of the access providers are the same, which is typically the case,
> > then we can safely call requests to refresh subdomains etc.
> >
> > QE actually even tests the IPA access provider (HBAC) for trusted users.
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> 
> You lost me a bit.
> Is LDAP access provider going to do searches against global catalog or not?
> If against GC everything should be fine but AFAIU it should be on a
> different port 3268.
> http://technet.microsoft.com/en-us/library/cc728188%28v=ws.10%29.aspx
> If against LDAP then it will be just local and would not see subdomains
> so rules for users from subdomains would not work.
> So if you do:
> 
> access_provider = ldap
> ldap_access_order = filter, expire
> ldap_account_expire_policy = ad
> ldap_access_filter = memberOf=cn=admins,ou=groups,dc=example,dc=com
> ldap_sasl_mech = GSSAPI
> ldap_sasl_authid = CLIENT_SHORTNAME$@EXAMPLE.COM
> ldap_schema = ad
> 
> 
> it will cover only root domain and not subdomains because there is no
> indication that the search should be against global catalog.
> What am I missing?

Hm, you're right, I was already thinking with the new option in mind. We
need to accelerate the new option, then.



More information about the sssd-devel mailing list