[SSSD-users] get ldap user by UPN with full name format

Jakub Hrozek jhrozek at redhat.com
Tue Apr 14 09:04:34 UTC 2015


On Tue, Apr 14, 2015 at 10:39:53AM +0300, Dimitar Dimitrov wrote:
> Hello everyone.
> I managed to configure ssh login for users by using pam_sss to our AD.
> The users use their usePrincipalName to authenticate. The providers for each
> of the domains are:
> 
> id_provider = ldap
> auth_provider = krb5
> chpass_provider = krb5
> access_provider = ldap
> 
> For the main domain this configuration works perfectly because the
> sAMAccountName is the same as the name(the first part from the
> user at domain.tld).
> But when I tried to configure one of the other domains I stuck in a
> following problem:
> The sAMAccountName of the users is differ than the UPN. For example user
> with UPN "test.linksync at linkoffice.fr" has a SAM "LINKSYNC".
> 
> When I try to get the user info for this by:
> 
> getent passwd test.linksync at linkoffice.fr
> 
> the authentication providers tries to get the user object from the LDAP with
> the following filter:
> [(&(userPrincipalName=test.linksync)(objectclass=user)(userPrincipalName=*)(objectSID=*))]
> 
> I thing that the problem here is with the id_provider. I tried to configure
> the re_expression and full_name_format options but they did not change
> anything in the request filter.
> Is there а way to change the behavior with which the id_provider gets the
> user object from the tree. For example I want to ask the ldap with the
> format user at domain and not only name.
> For example users logs with "test.linksync at linkoffice.fr" and the request
> for the id should be [(&(userPrincipalName=test.linksync at linkoffice.fr)(objectclass=user)(userPrincipalName=*)(objectSID=*))]

I think it's because you're using id_provider=ldap and not
id_provider=ad. The AD provider uses a different re_expression by
default which would match the UPNs.

I just tested login by UPN with ad provider and it works fine here,
even for a user with non-standard UPN suffix:
    (Tue Apr 14 04:58:28 2015) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): Requesting info for [upntest at another.suffix@AD.EXAMPLE.COM]

Is there any reason not to use id_provider=ad? Your configuration could be
much simpler and you'd get support for trusted domains in the same
forest automatically (and more features, like GPOs or DNS updates..)

See:
    https://fedorahosted.org/sssd/wiki/Configuring_sssd_with_ad_server

If you really really need ldap provider for some reson, the default AD
provider re_expression is:
    "(((?P<domain>[^\\\\]+)\\\\(?P<name>.+$))|" \
    "((?P<name>[^@]+)@(?P<domain>.+$))|" \
    "(^(?P<name>[^@\\\\]+)$))"  
(taken from source file, hence the linebreaks).


More information about the sssd-users mailing list