LDAP authentication and default groups

Question

I have multiple RHEL 7.4 servers with LDAP authentication via sssd. Conveniently, my university's LDAP environment has a UIDNumber attribute that is unique for every person. My sssd.conf is at the end of this question.

Here are my questions about this:

• Central IT runs two LDAP environments: Active Directory and "traditional" LDAP, both with usernames and passwords kept in sync. I cannot create groups on the LDAP environment, but I can in AD. Is there a way to say, "Authenticate users via LDAP, but a username's sAMAccountName has to match memberOf on this other LDAP server"? As it stands now, my ldap_user_search_base can turn into one heck of a filter when I have a lot of users.

• Also, I'd be interested to know if it's possible to automatically make groups for users. That is, when user jsmith with UID 12345 logs in, there's also a group jsmith with GID 12345 ready to go.

Thanks!

[domain/default]
autofs_provider = ldap
cache_credentials = True
ldap_search_base = dc=example,dc=edu
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldaps://ldap.example.edu:636
ldap_tls_reqcert = never
ldap_default_bind_dn = cn=proxy,ou=proxy-users,dc=example,dc=edu
ldap_default_authtok = lamepassword
ldap_user_object_class = exampleEduPerson
ldap_user_name = uid
ldap_user_uid_number = exampleEduUIDNumber
ldap_user_gid_number = exampleEduGIDNumber
ldap_user_gecos = exampleEduGECOS
ldap_user_uuid = exampleEduUID
ldap_id_mapping = False
override_shell = /bin/bash
override_homedir = /home/%u
debug_level = 5
ldap_user_search_base = uid=jsmith,ou=People,dc=example,dc=edu??
[sssd]
services = nss, pam, autofs
config_file_version = 2
domains = default
[nss]
homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]

Answer 1

I don't know about a way to configure SSSD in a way that you can collect information from different sources for one user. Even if that is possible Id strongly recommend to not do so to avoid mismatches.

What I'd recommend for the LDAP access:

• use one directory as main source. AD might be the one here.
• If this is not possible, ensure that all information needed is in LDAP. If you have some influence on the design decisions you might consider other tools to sync (I have experiences using Univention Corporate Server as LDAP instance synced with AD using the included Connector)
• If this also is not possible, you might need to add a dedicated service (third LDAP?) with some scripts that collects the needed information from the different sources

My recommendation for the "group per user": If such groups are really needed this should be done in the LDAP. Otherwise you can't be sure that the group has the same posix ID on the different servers.