[SSSD] review request for F21 gpo wiki page

Yassir Elley yelley at redhat.com
Tue Apr 1 21:23:31 UTC 2014



----- Original Message -----
> On Tue, Apr 01, 2014 at 10:57:23AM -0400, Yassir Elley wrote:
> > 
> > 
> > ----- Original Message -----
> > > On (31/03/14 17:34), Yassir Elley wrote:
> > > >Hi everyone,
> > > >
> > > >I have put together a Fedora 21 Self-Contained Change wiki page
> > > >for the GPO Access Control feature:
> > > >https://fedoraproject.org/wiki/Changes/SssdGpoBasedAccessControl.
> > > >
> > > >I would like to get the team's review and feedback before officially
> > > > submitting it to Jaroslav.
> > > >
> > > >Thanks,
> > > >Yassir.
> > > 
> > > 
> > > Test Client Setup:
> > > 
> > >    * use realmd (or some other mechanism) to join the test client to the
> > >         AD domain.
> > >    * make a note of the DN of the computer object that is created on the
> > >    AD
> > >         server as a result of the join step (e.g. "cn=f21-client,
> > >         ou=computers, dc=foo, dc=com").
> > >         In order for a GPO to be applicable to the test client, it must
> > >         be
> > >         linked to an ou parent or dc parent of the test client's DN (or
> > >         to
> > >         the site associated with the test client).
> > >    * install the sssd package and configure it to use "ad" for all
> > >    providers
> > >         (e.g. id, auth, access, etc).
> > > 
> > > Could we change order of points?
> > > 
> > > I thought that realmd will:
> > >    1. discover domain
> > >    2. install packages if PackageKit is installed
> > >    3. join test client to the AD domain.
> > 
> > I was spelling out the steps, but you are correct that "realm join" takes
> > care of all of this. How about the following text?
> > 
> > * use the "realm join <ad-domain-name>" command, which will:
> >   * install the required packages (including "sssd" and "sssd-ad")
> >   * join the test client to the AD domain
> >   * create a computer object in AD with the test client's hostname as its
> >   common-name (cn)
> >   * create an sssd configuration that uses "ad" for all providers (id,
> >   access, etc)
> > * make a note of the DN of the computer object (which represents the test
> > client).
> >   In order for a GPO to be applicable to the test client, it must be linked
> >   to an ou parent or dc parent of
> >   the test client's DN (or to the site associated with the test client).
> > 
> > Regards,
> > Yassir.
> 
> This sounds good to me. I think listing all the required steps is
> outside the scope of the F21 feature page. Maybe you could link to a
> realmd test day wiki page that has all the information?

OK. Here is the final text:

* if the test client is not already joined to an AD domain, execute the "realm join --user=Administrator <ad-domain-name>" command
  * the "realm join" command performs the test client setup (including domain join, SSSD package installation and SSSD configuration).
  * see http://fedoraproject.org/wiki/QA:Testcase_realmd_join_sssd for examples of using and troubleshooting the "realm join" command
* make a note of the DN of the computer object created by "realm join" (which represents the test client).
  * In order for a GPO to be applicable to the test client, it must be linked to an ou parent or dc parent of the test client's DN (or to the site associated with the test client).

Regards,
Yassir.



More information about the sssd-devel mailing list