<div class="gmail_quote">On Tue, May 3, 2011 at 7:39 AM, Stephen Gallagher <span dir="ltr"><<a href="mailto:sgallagh@redhat.com">sgallagh@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">On Tue, 2011-05-03 at 06:51 -0700, Ben Kevan wrote:<br>
> On Tue, May 3, 2011 at 4:47 AM, Stephen Gallagher<br>
> <<a href="mailto:sgallagh@redhat.com">sgallagh@redhat.com</a>> wrote:<br>
> On Mon, 2011-05-02 at 21:56 -0700, Ben Kevan wrote:<br>
> > I'm wondering what the heck I'm doing wrong. I'm working on<br>
> getting<br>
> > SSSD + KRB5 working against 2008 R2 AD. It's working fine in<br>
> RHEL5 w/<br>
> > the standard LDAP.conf configuration. I'm working on sssd,<br>
> but am not<br>
> > getting a binddn connection to AD. Here's my config:<br>
><br>
> ...<br>
> > ldap_default_bind_dn = <a href="mailto:ldapbinddn@DOMAIN.COM">ldapbinddn@DOMAIN.COM</a><br>
><br>
><br>
> This is not a DN. This is a username. It's not the same thing.<br>
> You need<br>
> to figure out ldapbinddn's full distinguished name in LDAP and<br>
> use that.<br>
><br>
><br>
><br>
><br>
> This wasn't the issue. You're able to use both the full DN, or the<br>
> shortened target method. It may not be documented, but if you're able<br>
> to traverse AD anonymously, then you'l ll be successful in the method<br>
> above. This is how I configured LDAP.con in RHEL5 even though it<br>
> requested the usage of a full DN.<br>
<br>
</div>That sounds like a non-standard extension, and I'd really advise against<br>
relying on it. I won't guarantee that we won't parse for a valid DN and<br>
reject it as an option (it may work right now, but I might call that a<br>
bug rather than a feature).<br>
<div class="im"><br>
><br>
><br>
> > wtf am I doing wrong, and is ldap for authentication better<br>
> then<br>
> > krb5? or should I stick with ldap for authorization and krb5<br>
> for<br>
> > authentication?<br>
><br>
><br>
> Using krb5 for authentication allows you to acquire a<br>
> single-sign-on TGT<br>
> for use with other applications, so it's probably the<br>
> preferred method<br>
> in your case.<br>
><br>
><br>
> The issue was the ldap_uri, where I had both targets space delimited<br>
> and not comma delimited.<br>
><br>
<br>
</div>Ah, yes. That's caused problems for people before as well.<br>
<div class="im"><br>
><br>
> However, I'm still having an issue with the results from getent passwd<br>
> <user>. Right now it's pulling / as homeDirectory, where homeDirectory<br>
> should report as /home/<user>. What mapping should this be on a 2008<br>
> R2 domain?<br>
><br>
<br>
</div>I'm guessing that ActiveDirectory isn't storing the homedir as the<br>
"homeDirectory" attribute by default. You'll have to look up what it<br>
should be in Windows Server 2008 R2, but at least on older systems the<br>
attribute would have been msSFU30HomeDirectory<br>
<br>
So you'd set<br>
ldap_user_home_directory = msSFU30HomeDirectory<br>
in the sssd.conf<br>
<div class="im"><br>
><br>
> Also, pulling a getent group <groupname> I'm not egtting the correct<br>
> list of members as it is in AD (in the pure ad group and not in the<br>
> msSFU30 portion)<br>
<br>
</div>You shouldn't be. You should only see the list of POSIX-compliant<br>
members. If the user or group members don't have POSIX attributes, we<br>
ignore them, since they aren't (and cannot be) relevant.<br></blockquote><div><br></div><div>Doing an ldap search of a group I get the following for members (without the antiquated methods of mapping msSFU30*)</div><div>
<div>member: CN=Unix bpm,OU=Service Accounts,OU=Users,OU=Corporate,,DC=Domain,DC=com</div><div>member: CN=Ben Kevan,OU=Standard Users,OU=Users,OU=Corporate,,DC=Domain,DC=com</div><div>distinguishedName: CN=NorCal Linux Admins,OU=Groups,DC=Domain,DC=com</div>
</div><div><br></div></div>Is there a way I can see what is being linked by default in sssd? Here's what I had in previous versions of ldap.conf for mapping, maybe that'll help map what they should be in SSSD easier. <div>
<br></div><div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div>nss_map_objectclass posixAccount User </div><div>nss_map_objectclass shadowAccount User </div><div>
nss_map_objectclass posixGroup group </div><div><br></div><div>nss_map_attribute uid sAMAccountName</div><div>nss_map_attribute uidNumber uidNumber</div><div>
nss_map_attribute gidNumber gidNumber</div><div>nss_map_attribute uniqueMember member</div><div>nss_map_attribute givenname givenName</div><div>nss_map_attribute ou description</div>
<div>nss_map_attribute gecos displayName</div><div>nss_map_attribute homeDirectory unixHomeDirectory</div><div>nss_map_attribute loginShell loginShell </div><div>nss_map_attribute shadowLastChange pwdLastSet</div>
<div><br></div><div>nss_base_passwd <meta http-equiv="content-type" content="text/html; charset=utf-8">DC=Domain,DC=com?sub</div><div>nss_base_shadow <meta http-equiv="content-type" content="text/html; charset=utf-8">DC=Domain,DC=com?sub</div>
<div>nss_base_group DC=Domain,DC=com?sub?&(objectCategory=group)(gidNumber=*)</div></div><div><br></div>