[SSSD-users] Login with Enterprise Principal Name with AD backend

Jakub Hrozek jhrozek at redhat.com
Mon May 26 11:13:04 UTC 2014

On Mon, May 26, 2014 at 09:46:22AM +0000, Longina Przybyszewska wrote:
> Hi  there,
> So what is the scenario for minimal possible AD mess - do not use at all  Posix Attributes?
> If we don't plan to use Nis services, but need Posix schema and Posix attributes for searching uid/gid /autofs maps- are we not safe?
> It is important decision for our project, as we are just about to ask for "messing AD" by attaching gid number for existing AD groups and keep gid number assigning  for all groups created in the future.
> It seems to be the rightest  way to achieve unique uid/gid on the Linux clients, as we have different kind of  storage (Sun storage) often with own algorithm of resolving Uids&group id from SID in AD forest with trusted domains.
> I even don't know how much mess is it with assigning gid number to all AD groups - is it just  a piece of cake which MS admins would love? ;(
> What could be the safe concept (not IPA yet ) for AD Linux integration with sssd to be on the safe side against MS decommissioning  of Unix Services ?
> Best
> Longina 

In my opinion, for the cases where you need to interact with several
different client implementations, defining the IDs directly on the
server side is the safest bet. It does, however, bring a bit more
maintenance to keep the IDs from overlapping etc.

It's possible to achieve some level of compatibility with e.g. winbind
using the ldap_idmap_autorid_compat option, but since you use completely
3rd party client software, then I guess the POSIX IDs are the best way.

I kind of doubt MSFT will ever remove the support for managing POSIX
IDs from AD, that would seriously damage their interoperability.

More information about the sssd-users mailing list