[SSSD-users] login with shortname in AD cross realm
Jakub Hrozek
jhrozek at redhat.com
Wed Jan 21 12:48:58 UTC 2015
On Wed, Jan 21, 2015 at 12:26:33PM +0000, Longina Przybyszewska wrote:
> Hi,
> Is it possible to configure SSSD to make possible to login with short names across trusty domains?
> The sAMAccount name attribute in AD are unique, and all users have Posix attributes assigned so there is no risk for name mismatch between different domains.
>
> I use ad provider and all default setting for AD backend(gc_search_enable) ;
>
> If use_fully_qualified_names = False only users from client machines native domain can login with shortnames; Users from other domains are "unknown".
>
> I can successfully make ldapsearch to Global Catalog in top domain for login names=shortname for users from different domains:
>
> ldapsearch -H ldap://ldap.c.example.com:3268 -Y GSSAPI -N -b "dc=c,dc=example,dc=org" "(&(objectClass=user)(sAMAccountName=user))"
> user = user-a from a.c.example.org
> user = user-b from b.c.example.org
>
> best,
> Longina
>
Only using the default_domain_suffix option, but then you need to
qualify the primary domain IIRC..
More information about the sssd-users
mailing list