[SSSD-users] Login with Enterprise Principal Name with AD backend

Jakub Hrozek jhrozek at redhat.com
Mon May 26 08:05:57 UTC 2014

On Sun, May 25, 2014 at 10:31:14PM +0000, Vinícius Ferrão wrote:
> Hello guys,
> I’m running sssd version 1.11 in Ubuntu 14.04 LTS (1.11.5-1ubuntu3) to authenticate users from Active Directory from WIndows Server 2012 R2, and I’m trying to achieve logins with the User Principal Name for all users of the domain. But the UPN are always Enterprise Principal Names.
> Let-me illustrate the problem with my user account:
> Domain: local.example.com
> sAMAccountName: ferrao
> UPN: ferrao at example.com (there’s no local in the UPN)
> I can successfully login with the sAMAccount atribute, which is fine, but I can’t login with ferrao at example.com which is my UPN. The optimum solution for me is to allow logins from sAMAccount and the UPN. If’s not possible, the UPN should be the right way instead of the sAMAccountName.

I'll let Sumit answer the above, I think he's already working on making
that possible.

> Another annoyance is the homedir pattern with those options in sssd.conf:
> default_shell = /bin/bash
> fallback_homedir = /home/%d/%u
> What I would like to achieve is separated home directories from the EPN. For example:
> /home/example.com/user
> /home/whatever.example.com/user
> But with this pattern I can’t map the way I would like to do.
> I’ve looked through man pages and was unable to find any answers for this issues.

I wonder if I understand your issue correctly, would you like to use the
UPN as a new template expansion? If so, then file a RFE please, that
should be an easy one to implement.

More information about the sssd-users mailing list