[SSSD-users] migrating from NIS to AD+kerberos

Jakub Hrozek jhrozek at redhat.com
Thu Feb 14 12:02:59 UTC 2013


On Thu, Feb 14, 2013 at 11:24:23AM +0000, Longina Przybyszewska wrote:
> UID/GID allocating – is my missing link.
> We need to renumber at least UIDs as they overlap across NIS domains.
> As all users have in advance AD account it seems obvious to me to generate posix uid based on AD IDs.
> 

If you're renumbering the UIDs (and by extension changing the file
permissions) anyway, you might as well go with the ID mapping feature
completely.

> …Or just assign Linux UIDs numbers  during migrating.
> What about making new accounts in the future – how the uid would be generated for Linux Users?
> Do we need a special group say ‘linuxusers’  then make a new template for new account in the group?
> Can AD make for us also continuously unique POSIX  UIDs when creating the new account?
> I don’t know YET much about MSWin identification process – sorry for very basic questions ;).
> 
> I understand that the approach with RID (real ID ??) mapping achieves consistent name mapping across all types file servers –
> am I right?

I'm not sure what you mean by "across all types of file servers" but
the mapping should be consistent, yes.

> But maybe in sssd context it doesn’t make sense – as Ondrej points out.
> 
> Ondrej, if you say “sssd can serve automount maps for automounter” – that means sssd can read ldap automounter map, and do
> it automatically if we define  autofs service in [nss] but first automounter has to know about sssd and link to sssd libraries?
> 

See http://jhrozek.livejournal.com/2500.html for example.


> Alternative,  now we have to convert NIS auto.home maps to ldap format, and load them to AD (???), then reconfigure automounter to
> ask AD for entry instead of NIS.
> By the way how do I find what class/attributes I want in AD-ldap for autofs?
> 
> Longina


More information about the sssd-users mailing list