By default we setup SSSD with auto-generated UNIX info (uid/gid/homedir/etc.), as this works on all networks. But many networks maintain this info as part of active directory using RFC2307 compatible LDAP attributes. We should have an option to use RFC 2307 with a given domain.
In order to use UIDs and GID from the POSIX attributes and not ID-map them, all you should set is; ldap_id_mapping = False I would have to check to be 100% sure, but I thought that the homedir, shell etc would be used automatically if present in the remote directory.
Created attachment 77876 [details] [review] Make realm_settings_boolean() accept a default value We're using these settings for a lot of admin configurable stuff and we can't expect per-realm defaults to be present in the installed files, so specify them in the code.
Created attachment 77877 [details] [review] Make realm_ini_config_set() accept more than one agrument pair This cleans up code a lot, and gives us a syntax similar to realm_ini_config_change().
Created attachment 77878 [details] [review] Option 'automatic-id-mapping' turns off id mapping This new per-realm option 'automatic-id-mapping = no' turns off automatic ID mapping, and makes sssd and winbind obey RFC2307 when configured.
Created attachment 77880 [details] [review] Make realm_settings_boolean() accept a default value Rebased on other patches
Created attachment 77881 [details] [review] Option 'automatic-id-mapping' turns off id mapping Updated patch to use lower case realm names when looking up settings
I think these are ready for review. Thanks in advance for looking it over.
Attachment 77877 [details] pushed as f3822b5 - Make realm_ini_config_set() accept more than one agrument pair Attachment 77880 [details] pushed as 666252b - Make realm_settings_boolean() accept a default value Attachment 77881 [details] pushed as fecf523 - Option 'automatic-id-mapping' turns off id mapping Pushed to matser. Review timed out, but I've tested this well, and would like to get it in for the test day coming up. More testing information here: https://fedoraproject.org/wiki/QA:Testcase_realmd_join_rfc2307
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.