[SSSD] New AD provider howto

Jakub Hrozek jhrozek at redhat.com
Thu Apr 17 10:18:01 UTC 2014


On Thu, Apr 17, 2014 at 09:05:42AM +0300, Marko Myllynen wrote:
> Hi,
> 
> On 2014-04-10 17:20, Jakub Hrozek wrote:
> > 
> > our current HOWTO[1] on connecting SSSD to an AD DC is outdated,
> > mostly because the page still only introduces the LDAP provider. Recently, me,
> > Sumit and Jeremy Agee wrote a new page that specifically advises to use
> > the AD provider and also use realmd for setup:
> > https://fedorahosted.org/sssd/wiki/Configuring_sssd_with_ad_server
> > 
> > We started a new page and kept the old one around mostly because pre-1.9
> > versions still need the LDAP provider info.
> > 
> > I'd like to get some review and feedback from our community so we can
> > link the wiki page from the front page or the documentation section. In
> > addition to the lists, I also CC-ed the individual contributors to the
> > original page directly..I hope that's fine.
> 
> I've been pretty detached from all this during the past year but perhaps
> that's only a good thing for the review..
> 
> In general all looks very nice and it was certainly a good move to write
> a new document. I have few nitpick comments, please see below and
> address/ignore them as you see appropriate (and please pardon me if any
> of these are copypastes from something I wrote for the old document :).

That's exactly why I CC-ed you and the other authors of the original
document -- you may remember strange quirks of the real environments :)

> 
> - I'd add LDP/ldapsearch examples to the GC section

Good idea, this might be helpful for the admin to compare the attribute
set between GC and LDAP.

> - for completeness sake I'd add dns_lookup_kdc = true and master_kdc =
> server.ad.example.com to the krb5.conf example

I've added dns_lookup_kdc, but I'm not sure about master_kdc, why do you
think it's needed? I normally prefer to stick to the defaults and let
the autodiscovery do its magic.

> - I'd add KRB5_TRACE=/dev/stdout kinit -V example somewhere, perhaps
> after the krb5.conf example

I agree, added.

> - I would at least comment out password server in smb.conf

Right, after re-reading the section in man smb.conf, I agree password
server should not be used.

> - a bit of grouping in smb.conf might make it more readable, e.g.
> security/realm/workgroup could be the first block, then logging options
> (location+level), then server options, then client options

Done.

I've changed the wiki page accordingly. Thanks a lot for the
suggestions!



More information about the sssd-devel mailing list