[SSSD-users] login with shortname in AD cross realm

Longina Przybyszewska longina at sdu.dk
Fri Jan 23 14:33:49 UTC 2015


 
> On (21/01/15 12:26), Longina Przybyszewska wrote:
> >Hi,
> >Is it possible to configure SSSD to make  possible to  login with short names
> across trusty domains?
> >The sAMAccount name attribute in AD  are unique, and all users have Posix
> attributes assigned so there is no risk for name  mismatch between different
> domains.
> >
> >I use ad provider and all  default setting for AD
> >backend(gc_search_enable) ;
> >
> >If use_fully_qualified_names = False only users from client machines native
> domain can login with shortnames; Users from other domains are
> "unknown".
> >
> >I can successfully make ldapsearch to Global Catalog in top domain for  login
> names=shortname for users from different domains:
> >
> >ldapsearch -H ldap://ldap.c.example.com:3268 -Y GSSAPI -N -b
> "dc=c,dc=example,dc=org"
> "(&(objectClass=user)(sAMAccountName=user))"
> >user = user-a from a.c.example.org
> >user = user-b from b.c.example.org
> >
> If there aren't the same user names(overlapping IDs)  in different AD
> domains then it could be possible to configure separate domains in sssd.conf.
> 
> Each domain should have disabled fqdn.
>    use_fully_qualified_names = false
> 
> If you plan to use id_provider = ad then you should also disable subdomain
> provider to avoin conflicts with other sssd domains.
>    subdomains_provider = none
> 
> I didn't test such setup. It needn't work but it worth to try it.

It seems to work! Thanks!  
I commented out default_domain_suffix.

Yes, we have unique Posix uidNumbers in the whole AD forest.
Best
longina
> 
> LS
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users


More information about the sssd-users mailing list