I have multiple RHEL 7.4 servers with LDAP authentication via sssd. Conveniently, my university's LDAP environment has a UIDNumber attribute that is unique for every person. My sssd.conf is at the end of this question.
Here are my questions about this:
Central IT runs two LDAP environments: Active Directory and "traditional" LDAP, both with usernames and passwords kept in sync. I cannot create groups on the LDAP environment, but I can in AD. Is there a way to say, "Authenticate users via LDAP, but a username's sAMAccountName has to match memberOf on this other LDAP server"? As it stands now, my ldap_user_search_base can turn into one heck of a filter when I have a lot of users.
Also, I'd be interested to know if it's possible to automatically make groups for users. That is, when user jsmith with UID 12345 logs in, there's also a group jsmith with GID 12345 ready to go.
[domain/default] autofs_provider = ldap cache_credentials = True ldap_search_base = dc=example,dc=edu id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldaps://ldap.example.edu:636 ldap_tls_reqcert = never ldap_default_bind_dn = cn=proxy,ou=proxy-users,dc=example,dc=edu ldap_default_authtok = lamepassword ldap_user_object_class = exampleEduPerson ldap_user_name = uid ldap_user_uid_number = exampleEduUIDNumber ldap_user_gid_number = exampleEduGIDNumber ldap_user_gecos = exampleEduGECOS ldap_user_uuid = exampleEduUID ldap_id_mapping = False override_shell = /bin/bash override_homedir = /home/%u debug_level = 5 ldap_user_search_base = uid=jsmith,ou=People,dc=example,dc=edu?? [sssd] services = nss, pam, autofs config_file_version = 2 domains = default [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp]