<div dir="ltr">Hi<div><br></div><div>sorry for coming back late</div><div><br></div><div>one correction that, it's ok to define a long group name in "cn" of objectClass posixGroup, it won't lead any issue when login the user via sssd ldap integration.</div>
<div><br></div><div>but have the otherthing want to confirm:</div><div>i set the "ldap_group_name = description", and set the value of "desciption" different with "cn", for example:</div><div>
<font color="#ff0000">cn=my-testing-group-at-world-wide-space</font></div><div><font color="#ff0000">description=test-group</font></div><div><br></div><div>the command "id nick" output:</div><div>uid=15001(nick) gid=20000(my-testing-group-at-world-wide-space) groups=20000(my-testing-group-at-world-wide-space)<br>
</div><div><br></div><div>it still use the value of "cn"</div><div><br></div><div>but, if i set </div><div><div>access_provider = simple</div><div># specify the long group name (as in 'cn')</div><div>simple_allow_groups = <font color="#ff0000">my-testing-group-at-world-wide-space</font></div>
</div><div><br></div><div>the usre 'nick' can't login (with error message incorrect password)</div><div><br></div><div>if i set to</div><div><div><div>access_provider = simple</div><div># specify short group name (as in 'description')</div>
<div>simple_allow_groups = <font color="#ff0000">test-group</font></div></div></div><div><br></div><div>the user 'nick' can login now.</div><div><br></div><div>so looks like there is some mismatch.</div><div><br>
</div>
<div><br></div></div><div class="gmail_extra"><br clear="all"><div> Thanks & Best Regards!<br><br> ///<br> (. .)<br> --------ooO--(_)--Ooo--------<br> | Nick Tan |<br>
------------------------------------<br></div>
<br><br><div class="gmail_quote">On Mon, Aug 4, 2014 at 8:48 PM, Jakub Hrozek <span dir="ltr"><<a href="mailto:jhrozek@redhat.com" target="_blank">jhrozek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="">On Sat, Aug 02, 2014 at 07:28:53AM +0800, XuQing Tan wrote:<br>
> Hi<br>
><br>
> i set the ldap_group_name = description in the sssd domain section. (i want<br>
> to map to 'description' rather than 'cn')<br>
> i cleaned the sssd cache file and restart sssd service<br>
> when i typed "id <user_id>", it still displayed the groupname as the "cn"<br>
><br>
> i'm using sssd 1.9.2 on CentOS 6.3:<br>
> [root]# rpm -qa|grep sssd<br>
> sssd-client-1.9.2-129.el6_5.4.x86_64<br>
> sssd-1.9.2-129.el6_5.4.x86_64<br>
><br>
> is it a defect?<br>
<br>
</div>Hard to tell without seeing the configuration and domain and sssd logs<br>
with debug_level=6 or higher.<br>
<div class="HOEnZb"><div class="h5">_______________________________________________<br>
sssd-users mailing list<br>
<a href="mailto:sssd-users@lists.fedorahosted.org">sssd-users@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a><br>
</div></div></blockquote></div><br></div>