[SSSD-users] Map an AD group to a local group
Brendan Kearney
bpk678 at gmail.com
Sat Aug 1 13:03:48 UTC 2015
On 07/30/2015 07:42 AM, Domenico Viggiani wrote:
>> You can put any centralized account into a local group, but you need to
>> do it on all clients. I have an LDAP account "jhrozek" that is a member
>> of local group mock:
>>
>> $ grep mock /etc/group
>> mock:x:135:jhrozek
> OK, I know but I'd like to avoid to insert AD developers' account in the local group one by one :(
>
> Thanks again
> --
>
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
i have a setup that allows me to centrally manage local groups. maybe it
can help here.
because i am using RFC2307bis in openldap, which windows AD supports, i
can have groupOfNames groups with an additional objectClass of posixGroup.
i installed the migrationtools package, so i could use the scripts to
create the posix user, group, etc info in ldap. it took some minor
modifications to the scripts to output the data in ldif format according
to my DIT hierarchy. i then ran the script and imported the ldif. i
now have all the posix info in my DIT.
by adding the posixAccount objectClass to my user object in ldap, which
has the inetOrgPerson structural objectClass, i can add uid/gid values
to the object. if i add my user object to one of the groupOfNames
groups that has the additional posixAccount objectClass, i can see my id
in that group when i log into a box and run "id".
using sssd, and configuring /etc/nsswitch.conf to point to sss for
group, as primary and files as secondary, i get to use the centrally
managed local groups on all of my hosts. i make one change and all
devices get the update (upon logout and then login). nsswitch.conf
points passwd, shadow, sudoers, netgroup, and automount to files as
primary and sss as secondary. i made sure to leave passwd as files
first, so that root is always local, and can login should the network or
directory not be available.
More information about the sssd-users
mailing list