SSSD using POSIX attributes

Issues related to configuring your network
Post Reply
neutronsnowball
Posts: 16
Joined: 2016/10/27 18:09:29

SSSD using POSIX attributes

Post by neutronsnowball » 2018/02/08 18:39:58

SSSD does not appear to be able to grab the POSIX values from AD. With

Code: Select all

ldap_id_mapping = False
we get:
# id bob
id: bob: no such user

When we switch it to

Code: Select all

ldap_id_mapping = True
it generates a non-POSIX ID number which is incompatible with our file store.

Fresh CentOS 7 install w/latest updates
yum install chrony realmd oddjob oddjob-mkhomedir sssd adcli samba-common-toolskrb5-workstation -y
chrony points to the AD servers - time matches

Machine was joined using

Code: Select all

realm join --automatic-id-mapping=no int.domain.com
/etc/sssd/sssd.conf was edited to set

Code: Select all

use_fully_qualified_names = False
After editing,

Code: Select all

systemctl stop sssd && rm -f /var/lib/sss/db/* && systemctl start sssd
is executed.

Firewalls are open, Active Directory Schema MMC snap-in was enabled and publishes: uidNumber, gidNumber, unixHomeDirectory, and loginShell.

The documentation we followed is:
https://access.redhat.com/documentation ... de/sssd-ad
Is there a better reference for this somewhere else?

neutronsnowball
Posts: 16
Joined: 2016/10/27 18:09:29

Re: SSSD using POSIX attributes

Post by neutronsnowball » 2018/02/08 19:59:18

It looks like we've had a breakthrough! The attributes mentioned above were not published for all users (nor the user I was testing with).

By manually updating those attributes through the AD Users & Computers tool the results are positive! Now to find a script to automate updating the attributes for all users...

Post Reply