[SSSD] review request for F21 gpo wiki page

Yassir Elley yelley at redhat.com
Tue Apr 1 14:57:23 UTC 2014



----- Original Message -----
> On (31/03/14 17:34), Yassir Elley wrote:
> >Hi everyone,
> >
> >I have put together a Fedora 21 Self-Contained Change wiki page
> >for the GPO Access Control feature:
> >https://fedoraproject.org/wiki/Changes/SssdGpoBasedAccessControl.
> >
> >I would like to get the team's review and feedback before officially
> > submitting it to Jaroslav.
> >
> >Thanks,
> >Yassir.
> 
> 
> Test Client Setup:
> 
>    * use realmd (or some other mechanism) to join the test client to the
>         AD domain.
>    * make a note of the DN of the computer object that is created on the AD
>         server as a result of the join step (e.g. "cn=f21-client,
>         ou=computers, dc=foo, dc=com").
>         In order for a GPO to be applicable to the test client, it must be
>         linked to an ou parent or dc parent of the test client's DN (or to
>         the site associated with the test client).
>    * install the sssd package and configure it to use "ad" for all providers
>         (e.g. id, auth, access, etc).
> 
> Could we change order of points?
> 
> I thought that realmd will:
>    1. discover domain
>    2. install packages if PackageKit is installed
>    3. join test client to the AD domain.

I was spelling out the steps, but you are correct that "realm join" takes care of all of this. How about the following text?

* use the "realm join <ad-domain-name>" command, which will:
  * install the required packages (including "sssd" and "sssd-ad")
  * join the test client to the AD domain
  * create a computer object in AD with the test client's hostname as its common-name (cn)
  * create an sssd configuration that uses "ad" for all providers (id, access, etc)
* make a note of the DN of the computer object (which represents the test client).
  In order for a GPO to be applicable to the test client, it must be linked to an ou parent or dc parent of
  the test client's DN (or to the site associated with the test client).

Regards, 
Yassir.



More information about the sssd-devel mailing list