[SSSD-users] default filters for group search

Lukas Slebodnik lslebodn at redhat.com
Tue Apr 7 07:19:48 UTC 2015


On (04/04/15 16:32), Dmitri Pal wrote:
>On 04/04/2015 04:13 PM, rone wrote:
>>Dmitri Pal writes:
>>>May be we should step back and discuss your environment.
>>>What do you have and what are you trying to accomplish?
>>Right now, these OpenStack hosts have sssd configured to allow login
>>via PAM/LDAP against their AD credentials for individual users (as per
>>/etc/security/access.conf).  The goal is to allow login to AD groups,
>>where groups are AD distribution lists.
>>
>>thanks
>>rone
>But you do not have POSIX in AD at least for groups.
>And you do not want to join systems into AD.
>So in this case AFAIU you have to use the LDAP provider and treat AD as
>generic LDAP server but add some specific AD related setting on top.
>Can you share your sssd. conf that you currently have?
>Please clean it up from sensitive data like domain and host names before
>sending to the list.
>

We do not have described such configuration on one page.
You can inspire in next configurations desctibed in documentation [1,2]

The first link[1] describe differences between ID mapping and using
POSIX attributes. It also explain how ID maaping works in sssd.
At the end of section, there is the simplest configuration for ID mapping with
sssd:
    ldap_id_mapping = True
    ldap_schema = ad

Although the 2nd link[2] says "Configuring Active Directory as an LDAP Domain"
there is still some krb5 related part of configuration. It should work if you
replace value of options from krb5 -> ldap.

Please beaware of fact that 2nd configuration us ldap_schema rfc2307bis,
which requires POSIX attributes in Active Directory. So you should replace it
with configuration snippet for ID mapping.

LS

[1] https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/Configuring_Domains.html#sssd-ad-users
[2] https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/Configuring_Domains.html#sssd-ad-ldap-proc


More information about the sssd-users mailing list