[SSSD] review request for F21 gpo wiki page

Jakub Hrozek jhrozek at redhat.com
Tue Apr 1 20:37:13 UTC 2014


On Tue, Apr 01, 2014 at 10:57:23AM -0400, Yassir Elley wrote:
> 
> 
> ----- Original Message -----
> > On (31/03/14 17:34), Yassir Elley wrote:
> > >Hi everyone,
> > >
> > >I have put together a Fedora 21 Self-Contained Change wiki page
> > >for the GPO Access Control feature:
> > >https://fedoraproject.org/wiki/Changes/SssdGpoBasedAccessControl.
> > >
> > >I would like to get the team's review and feedback before officially
> > > submitting it to Jaroslav.
> > >
> > >Thanks,
> > >Yassir.
> > 
> > 
> > Test Client Setup:
> > 
> >    * use realmd (or some other mechanism) to join the test client to the
> >         AD domain.
> >    * make a note of the DN of the computer object that is created on the AD
> >         server as a result of the join step (e.g. "cn=f21-client,
> >         ou=computers, dc=foo, dc=com").
> >         In order for a GPO to be applicable to the test client, it must be
> >         linked to an ou parent or dc parent of the test client's DN (or to
> >         the site associated with the test client).
> >    * install the sssd package and configure it to use "ad" for all providers
> >         (e.g. id, auth, access, etc).
> > 
> > Could we change order of points?
> > 
> > I thought that realmd will:
> >    1. discover domain
> >    2. install packages if PackageKit is installed
> >    3. join test client to the AD domain.
> 
> I was spelling out the steps, but you are correct that "realm join" takes care of all of this. How about the following text?
> 
> * use the "realm join <ad-domain-name>" command, which will:
>   * install the required packages (including "sssd" and "sssd-ad")
>   * join the test client to the AD domain
>   * create a computer object in AD with the test client's hostname as its common-name (cn)
>   * create an sssd configuration that uses "ad" for all providers (id, access, etc)
> * make a note of the DN of the computer object (which represents the test client).
>   In order for a GPO to be applicable to the test client, it must be linked to an ou parent or dc parent of
>   the test client's DN (or to the site associated with the test client).
> 
> Regards, 
> Yassir.

This sounds good to me. I think listing all the required steps is
outside the scope of the F21 feature page. Maybe you could link to a
realmd test day wiki page that has all the information?



More information about the sssd-devel mailing list