ldap provider variables for AD trust

[iulian roman]

Hello, 

I have some old clients (sssd 1.9) for which I need to use ldap provider in sssd.conf.
Does anyone know how ldap_search_base variables should look like in order to resolve the
AD users ? 
With the default settings, it does resolve the posix users/groups from IPA but not the AD
users.

[Rob Crittenden]

iulian roman via FreeIPA-users wrote:
>  Hello, 
>  
>  I have some old clients (sssd 1.9) for which I need to use ldap provider in sssd.conf.
> Does anyone know how ldap_search_base variables should look like in order to resolve the
> AD users ? 
>  With the default settings, it does resolve the posix users/groups from IPA but not the AD
> users. 
I believe you need to use the compat tree: cn=compat,dc=example,dc=test

rob

[iulian roman]

I have tried with that one already, but unfortunately it does not resolve the trusted AD
users.

[Florence Renaud]

Hi,
for the entries stored on AD side, the compat tree creates entries on
demand, and only when specific search filters are used (the same ones as
posix-compliant systems would use) . You can find the list of supported
search filters in RFC 2307 (rfc2307#section-5.2
<https://datatracker.ietf.org/doc/html/rfc2307#section-5.2>).

This means for instance that in order to find the AD user bob(a)ad.com on the
compat tree, your search filter should look like

(&amp;(objectClass=posixAccount)(uid=bob(a)ad.com))

Once this search filter has been used, the compat tree is populated
and the entry can be found.
It implies that if you run id bob(a)ad.com, the compat tree will also be
populated with the entry for bob(a)ad.com.
Hope this clarifies,

flo


On Mon, Aug 23, 2021 at 9:08 AM iulian roman via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org&gt; wrote:

>  I have tried with that one already, but unfortunately it does not
> resolve
>  the trusted AD users.
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>