[SSSD-users] uid/gid allocation strategy

Dmitri Pal dpal at redhat.com
Tue Jan 28 18:18:04 UTC 2014


On 01/28/2014 03:37 AM, Sumit Bose wrote:
> On Tue, Jan 28, 2014 at 12:36:09AM +0000, Nordgren, Bryce L -FS wrote:
>> Can sssd allocate uid/gid out of a pool unique to each domain? The mapping need not be complex: "last_allocated+1" should suffice.
> SSSD supports a simple mapping based on the RIDs of the users and
> groups. You can find details in the sssd-ad man page in the 'ID MAPPING'
> section. Does this scheme work for you?
>
> HTH
>
> bye,
> Sumit
>
>> I'm motivated to ask the following question because I "supplement" our official active directory with accounts for external partners/collaborators. Numeric uid/gid fields could well collide because there's no coordination, nor is there likely to be. In the long term, we'd like to fix that, and we'd like to convince our powers-that-be that joining one or more larger "identity federations" is in their best interest. But that puts us right back where we started, as uid/gids across several large, mostly disconnected organizations are not going to be coordinated.
>>
>> So: What reasons still exist to insist on coordination? Are we ready to make the leap to coordinating the set of text-based-principals which are valid within a domain?
>>
>> File sharing via NFS with "sec=sys" is just about the only obstruction I can think of. Otherwise, uid/gids are local to each machine, and it is sufficient to allow each machine to perform its own unique mapping from "valid username" to uid.
>>
>> So if I either prohibit NFS entirely or insist on "sec=krb5", could I have a gaggle of linux boxes which individually allocate uids and gids as they encounter valid Kerberos credentials?
>>
>> Sorry for wandering into the abstract there...this seemed an appropriate venue for determining whether such a scheme was viable.
>>
>> Bryce
>>
>>
>>
>>
>> This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.
>> _______________________________________________
>> sssd-users mailing list
>> sssd-users at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users

You also may consider bringing FreeIPA to manage you Linux boxed and
provide uid/gid data while users from AD would come via trust or sync.
Have you looked at this avenue?

-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/





More information about the sssd-users mailing list