On Fri, Nov 29, 2013 at 03:17:44PM +0100, Ben Morrice wrote:
Hello,
I am trying to use sssd in our environment where unfortunately we have a broken ldap implementation with no options to fix it.
We have an openldap implementation where our 'uid' field can contain many attributes, some containing a 'uid' and others containing 'uid@functional-unit'. Some users have in their ldap account a single 'uid@functional-unit' whereas others have 'uid' and potentially many 'uid@functional-unit'.
sssd does the right thing for most cases with multiple attributes; just providing the first returned attribute (which is 'uid'). However I am experiencing problems with users that have only a 'uid@functional-unit' entry.
I want to configure sssd so that both 'uid' and 'uid@functional-unit' are represented from sssd as 'uid'
I'm not sure there is a way to have both format represented as uid, sorry.
Please see below for some examples of what i'm talking about and my current configuration.
[~]$ getent passwd user1 user1:*:90001:20010:user1:/home/user1:/bin/bash [~]$ getent passwd |grep user2 user2@functional-unit:*:85010:20010:user2:/home/user2@functional-unit:/bin/bash [~]$ Note: I can't do a 'getent passwd user2' or 'getent passwd user2@functional-unit' - neither options work.
You'd have to query the name as present in LDAP, that us user@functional-unit. The reason it doesn't work out-of-the box is that the SSSD uses username@domain to qualify entries in one particular domain. You can change that setting with: re_expression = (?P<name>.+)
in the [sssd] or [domain] section.
I would advise to fix your server..