[SSSD-users] login with shortname in AD cross realm

Longina Przybyszewska longina at sdu.dk
Wed Jan 21 12:26:33 UTC 2015


Hi,
Is it possible to configure SSSD to make  possible to  login with short names across trusty domains?
The sAMAccount name attribute in AD  are unique, and all users have Posix attributes assigned so there is no risk for name  mismatch between different domains.

I use ad provider and all  default setting for AD backend(gc_search_enable) ;

If use_fully_qualified_names = False only users from client machines native domain can login with shortnames; Users from other domains are "unknown".

I can successfully make ldapsearch to Global Catalog in top domain for  login names=shortname for users from different domains:

ldapsearch -H ldap://ldap.c.example.com:3268 -Y GSSAPI -N -b "dc=c,dc=example,dc=org" "(&(objectClass=user)(sAMAccountName=user))"
user = user-a from a.c.example.org
user = user-b from b.c.example.org

best,
Longina

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20150121/3df7b771/attachment.html>


More information about the sssd-users mailing list