<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">I have two more questions for my own
knowledge and maybe those of others :<br>
<br>
* 1st question :<br>
If 2 users, a local user called "aminata" and a domain user
"aminata@domain" exist, how does sssd choose who we are when we
ssh in the system with a username of "aminata" and the
re_expressions is set to:<br>
<br>
"(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))"<br>
<br>
which allows three different
styles for user names:
<dl compact="compact">
<dd>• username
</dd>
<dd>• <a href="mailto:username@domain.name">username@domain.name</a>
</dd>
<dd>• domain\username
</dd>
</dl>
?<br>
<br>
* 2nd question :<br>
If we have two AD domains A and B. A linux machine is in the
domain B, and we want the users from domain A to be able to
authenticate in the linux machine. Our sssd configuration is
id_provider=ldap (<a class="moz-txt-link-freetext" href="ldaps://auth.domainA.com">ldaps://auth.domainA.com</a>), auth_provider=krb5
(auth.domainA.com). A keytab was generated for the linux machine
on domain B AD and installed on the machine. Is this architecture
possible without using a trust relationship from domain A to
domain B ? My first thought is that it's not possible since the
linux system belonging to domain B needs to be able to browse the
directory of domain A.<br>
<br>
Thanks in advance for your replies.<br>
<br>
Mathieu<br>
<br>
Le 26/06/2013 23:10, Jakub Hrozek a écrit :<br>
</div>
<blockquote cite="mid:20130626211018.GH5719@hendrix.brq.redhat.com"
type="cite">
<pre wrap="">On Wed, Jun 26, 2013 at 08:23:40PM +0200, Mathieu Bouillaguet wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I solved my problem thanks to your reply :-)
For the others, my access provider is ldap and I didn't configured the
ldap_access_filter. If ldap_access_filter isn't configured and filter is in
the ldap_access_order (which is the default when it's not specified) all
users are denied access.
After having configured ldap_access_filter with a valid
memberOf=cn=authorizedUsersGroup, ou=... and added my users to this group
on the DC everything work as expected.
</pre>
</blockquote>
<pre wrap="">
Hi Mathieu,
you're not the first to run into this issue, so the latest SSSD versions
clarify the access order better in the man pages.
I'm glad it's working for you now!
_______________________________________________
sssd-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a>
</pre>
</blockquote>
<br>
</body>
</html>