0

I use an Active Directory server for authentication,Solaris works fine following this Howto.

All works,and my user "user1" get the right UID assigned on Windows AD,which is 10000.

On linux I follow this howto and I can join the AD..user works but..id is totally different,not 10000 but "uid=744201108",how to get the correct uid on linux? This is my sssd

[sssd]
domains = server.example
config_file_version = 2
services = nss, pam

[domain/server.example]
ad_domain = server.example
krb5_realm = SERVER.EXAMPLE
realmd_tags = manages-system joined-with-adcli 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = false
fallback_homedir = /home/%u@%d
access_provider = ad

# needed to use correct active directory properties (Windows Server 2003)
ldap_schema = ad
ldap_user_object_class = person
ldap_user_name = msSFU30Name
ldap_user_uid_number = msSFU30UidNumber
ldap_user_gid_number = msSFU30GidNumber
ldap_user_home_directory = msSFU30HomeDirectory
ldap_user_shell = msSFU30LoginShell
ldap_user_gecos = displayName
ldap_group_object_class = group
ldap_group_name = msSFU30Name
ldap_group_gid_number = msSFU30GidNumber

# id 
ldap_idmap_autorid_compat = true
2

The SSSD docs cover this in some detail. Essentially, by default when SSSD is used to join a new domain, it assigns a block of UID's designed to be unique to that domain, that override any that AD might have assigned. This allows multiple domains to be used, and ensure that users from all domains get unique UID's.

This portion of the docs, I think gives you the info you need. (Basically, set ldap_id_mapping = False, restart SSSD and clear caches)

0

Alternative solution,using this sssd.conf works perfect,is based on ldapclient setting of solaris.

[sssd]
domains = server.example
config_file_version = 2
services = nss, pam

[domain/server.example]
ad_domain = server.example
krb5_realm = SERVER.EXAMPLE
realmd_tags = manages-system joined-with-adcli 
cache_credentials = True
krb5_store_password_if_offline = True
default_shell = /bin/bash
use_fully_qualified_names = False
fallback_homedir = /home/%u@%d
min_id = 10000
max_id = 20000
override_homedir = /home/%u
access_provider = ldap
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
ldap_uri = ldap://windowserver.example.domain
ldap_search_base = dc=server,dc=example
ldap_default_bind_dn = cn=proxyldap,cn=Users,dc=server,dc=example
ldap_default_authtok_type = password
ldap_default_authtok = *********YOURPASSHERE*****
ldap_id_use_start_tls = False
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_schema = rfc2307bis
ldap_user_principal = userPrincipalName
ldap_user_fullname = displayName
ldap_user_name = sAMAccountName
ldap_user_object_class = user
ldap_user_home_directory = unixHomeDirectory
ldap_user_shell = msSFU30LoginShell
ldap_group_object_class = group
ldap_force_upper_case_realm = true
ldap_group_uuid = objectGUID
ldap_user_uuid = objectGUID
ldap_user_gid_number = gidNumber
ldap_user_uid_number = uidNumber

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.