[SSSD-users] nss_cmd_initgroups searching only one ldap domain

Zachary Hanson-Hart zachhh at temple.edu
Mon Feb 25 19:18:11 UTC 2013


Zachary Hanson-Hart <zachhh <at> temple.edu> writes:

> 
> Dmitri Pal <dpal <at> redhat.com> writes:

> >     What you can do is for groups use
> >     sss ldap 
> >     or may be even just ldap
> >     in nsswitch.conf and use SSSD for users and configure nss_ldap for
> >     groups.
> >     I am not sure whether that would work but it is worth a try.


This turned out to work perfectly.  Leaving the authentication LDAP server in
sssd.conf as both an id and auth provider gives the necessary user information,
and then subsequently, nss_ldap for groups gives all of the appropriate
additional groups.  


nsswitch.conf:
passwd: compat sss
group:  compat ldap
...

/etc/ldap.conf:
uri   ldaps://group.server
...

/etc/sssd/sssd.conf:
[sssd]
domains   userldap
...

[domain/userldap]
ldap_uri       ldaps://authentication.server
id_provider    ldap
auth_provider  ldap
...


PHEW!  Thanks for your advice, Dmitri.  

> >       _______________________________________________
> > sssd-users mailing list
> > sssd-users <at> lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> > 
> >     
> >     -- 
> > Thank you,
> > Dmitri Pal
> > 
> > Sr. Engineering Manager for IdM portfolio
> > Red Hat Inc.
> > 
> > 
> > -------------------------------
> > Looking to carve out IT costs?
> > www.redhat.com/carveoutcosts/
> > 
> > 
> > 
> >   
> > 
> > _______________________________________________
> > sssd-users mailing list
> > sssd-users <at> lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> > 
> 
> _______________________________________________
> sssd-users mailing list
> sssd-users <at> lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> 






More information about the sssd-users mailing list