[SSSD-users] FW: login with shortname in AD cross realm

Longina Przybyszewska longina at sdu.dk
Fri Jan 23 10:12:30 UTC 2015


 > > > Only using the default_domain_suffix option, but then you need to
>> > > qualify the primary domain IIRC..
 > >
 > > You mean,, I have to have on all machines default-domain_suffix = c.example.org.
 >
 > Yes.
> > I am not sure that I understand the "qualify the primary domain IIRC"del...
> What I meant is if you had the main domain called example.com,
 > subdomain called c.example.com and set the suffix to c.example.com,
 > then retrieving users from the main domain would require appending the
 > domain name:
 >     getent passwd administrator at example.com But subdomain users couldbe un-qualified
 >     getent passwd some_user_from_subdomain
 >
> Also, I wonder if using the fully qualified name, or the netbios name
> is really a problem? After all, that's how it's done in Windows..

 > > If client machines and servers were in  c.example.org natively, user left in
> > subdomains -would it help?

 > Not sure I understand, but if all users are in subdomains, then using
 > default_domain_suffix makes sense.
 
Yes, all users are in subdomains, but there are also users in top domain
c.example.org.


 I traced NFS4 idmaping problem to ' nss_getpwname' call ; Idmapd on the
 NFS server can  so far resolve only unqualified names  local for its domain  ;
 
 I would like to be able to resolve 'nss_getpwname' call for

 userA (from A.C.EXAMPLE.ORG), and

 userB (from B.C.EXAMPLE.ORG) and

 for userC (from C.EXAMPLE.ORG) 

with their respectively unqualified names on the NFS server and nfs client machine;
 
 Could lookup be  more simple  if server and client machines  join C.EXAMPLE.ORG?

Best,
Longina


More information about the sssd-users mailing list