Hello,
When one uses SSSD with AD provider but user comes from a subdomain there are implications for the access provider. AFAIU we have a ticket for simple access provider: https://fedorahosted.org/sssd/ticket/2034 but what about other access providers? What are the implications? And what would be the best practices in configuring SSSD in this case? What access provider would we recommend?
I envision a wiki page titled: "HOWTO/Selecting the best access control configuration for the SSSD AD provider". That should cover different use cases and give recommendations based on the use case.
On Sat, Sep 07, 2013 at 07:26:51PM -0400, Dmitri Pal wrote:
Hello,
When one uses SSSD with AD provider but user comes from a subdomain there are implications for the access provider. AFAIU we have a ticket for simple access provider: https://fedorahosted.org/sssd/ticket/2034 but what about other access providers? What are the implications? And what would be the best practices in configuring SSSD in this case? What access provider would we recommend?
Yes, I was thinking about these use cases after the recent sssd-users thread. The exact use-case that was described is very common so I think we should react.
For the AD provider, I think we might add one more configuration option "ad_access_filter" that, if set, would augment the AD access provider so that it first checks if the account is expired and if it's not, then proceed to check if the account matches the filter without having to configure the LDAP provider.
I envision a wiki page titled: "HOWTO/Selecting the best access control configuration for the SSSD AD provider". That should cover different use cases and give recommendations based on the use case.
I agree. So I think we should open two tickets -- one for the documentation and one for the option. Do you agree?
On 09/08/2013 06:07 PM, Jakub Hrozek wrote:
On Sat, Sep 07, 2013 at 07:26:51PM -0400, Dmitri Pal wrote:
Hello,
When one uses SSSD with AD provider but user comes from a subdomain there are implications for the access provider. AFAIU we have a ticket for simple access provider: https://fedorahosted.org/sssd/ticket/2034 but what about other access providers? What are the implications? And what would be the best practices in configuring SSSD in this case? What access provider would we recommend?
Yes, I was thinking about these use cases after the recent sssd-users thread. The exact use-case that was described is very common so I think we should react.
For the AD provider, I think we might add one more configuration option "ad_access_filter" that, if set, would augment the AD access provider so that it first checks if the account is expired and if it's not, then proceed to check if the account matches the filter without having to configure the LDAP provider.
I envision a wiki page titled: "HOWTO/Selecting the best access control configuration for the SSSD AD provider". That should cover different use cases and give recommendations based on the use case.
I agree. So I think we should open two tickets -- one for the documentation and one for the option. Do you agree?
Yes, and the one for option should start with a design page on wiki extracting information from this thread.
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
On Sun, Sep 08, 2013 at 09:13:46PM -0400, Dmitri Pal wrote:
On 09/08/2013 06:07 PM, Jakub Hrozek wrote:
On Sat, Sep 07, 2013 at 07:26:51PM -0400, Dmitri Pal wrote:
Hello,
When one uses SSSD with AD provider but user comes from a subdomain there are implications for the access provider. AFAIU we have a ticket for simple access provider: https://fedorahosted.org/sssd/ticket/2034 but what about other access providers? What are the implications? And what would be the best practices in configuring SSSD in this case? What access provider would we recommend?
Yes, I was thinking about these use cases after the recent sssd-users thread. The exact use-case that was described is very common so I think we should react.
For the AD provider, I think we might add one more configuration option "ad_access_filter" that, if set, would augment the AD access provider so that it first checks if the account is expired and if it's not, then proceed to check if the account matches the filter without having to configure the LDAP provider.
I envision a wiki page titled: "HOWTO/Selecting the best access control configuration for the SSSD AD provider". That should cover different use cases and give recommendations based on the use case.
I agree. So I think we should open two tickets -- one for the documentation and one for the option. Do you agree?
Yes, and the one for option should start with a design page on wiki extracting information from this thread.
New option: https://fedorahosted.org/sssd/ticket/2082
Documentation: https://fedorahosted.org/sssd/ticket/2083
I also realized I didn't answer your original question about the other access providers and how they relate to subdomains. I think the fact that the subdomain access provider didn't work was quite a special case, because the main problem was that in the SSSD, it's not really easy to call a method of one provider (AD) from other provider (simple). If the types of the access providers are the same, which is typically the case, then we can safely call requests to refresh subdomains etc.
QE actually even tests the IPA access provider (HBAC) for trusted users.
On 09/09/2013 04:28 AM, Jakub Hrozek wrote:
On Sun, Sep 08, 2013 at 09:13:46PM -0400, Dmitri Pal wrote:
On 09/08/2013 06:07 PM, Jakub Hrozek wrote:
On Sat, Sep 07, 2013 at 07:26:51PM -0400, Dmitri Pal wrote:
Hello,
When one uses SSSD with AD provider but user comes from a subdomain there are implications for the access provider. AFAIU we have a ticket for simple access provider: https://fedorahosted.org/sssd/ticket/2034 but what about other access providers? What are the implications? And what would be the best practices in configuring SSSD in this case? What access provider would we recommend?
Yes, I was thinking about these use cases after the recent sssd-users thread. The exact use-case that was described is very common so I think we should react.
For the AD provider, I think we might add one more configuration option "ad_access_filter" that, if set, would augment the AD access provider so that it first checks if the account is expired and if it's not, then proceed to check if the account matches the filter without having to configure the LDAP provider.
I envision a wiki page titled: "HOWTO/Selecting the best access control configuration for the SSSD AD provider". That should cover different use cases and give recommendations based on the use case.
I agree. So I think we should open two tickets -- one for the documentation and one for the option. Do you agree?
Yes, and the one for option should start with a design page on wiki extracting information from this thread.
New option: https://fedorahosted.org/sssd/ticket/2082
Documentation: https://fedorahosted.org/sssd/ticket/2083
I also realized I didn't answer your original question about the other access providers and how they relate to subdomains. I think the fact that the subdomain access provider didn't work was quite a special case, because the main problem was that in the SSSD, it's not really easy to call a method of one provider (AD) from other provider (simple). If the types of the access providers are the same, which is typically the case, then we can safely call requests to refresh subdomains etc.
QE actually even tests the IPA access provider (HBAC) for trusted users. _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
You lost me a bit. Is LDAP access provider going to do searches against global catalog or not? If against GC everything should be fine but AFAIU it should be on a different port 3268. http://technet.microsoft.com/en-us/library/cc728188%28v=ws.10%29.aspx If against LDAP then it will be just local and would not see subdomains so rules for users from subdomains would not work. So if you do:
access_provider = ldap ldap_access_order = filter, expire ldap_account_expire_policy = ad ldap_access_filter = memberOf=cn=admins,ou=groups,dc=example,dc=com ldap_sasl_mech = GSSAPI ldap_sasl_authid = CLIENT_SHORTNAME$@EXAMPLE.COM ldap_schema = ad
it will cover only root domain and not subdomains because there is no indication that the search should be against global catalog. What am I missing?
On Mon, Sep 09, 2013 at 08:35:32AM -0400, Dmitri Pal wrote:
On 09/09/2013 04:28 AM, Jakub Hrozek wrote:
On Sun, Sep 08, 2013 at 09:13:46PM -0400, Dmitri Pal wrote:
On 09/08/2013 06:07 PM, Jakub Hrozek wrote:
On Sat, Sep 07, 2013 at 07:26:51PM -0400, Dmitri Pal wrote:
Hello,
When one uses SSSD with AD provider but user comes from a subdomain there are implications for the access provider. AFAIU we have a ticket for simple access provider: https://fedorahosted.org/sssd/ticket/2034 but what about other access providers? What are the implications? And what would be the best practices in configuring SSSD in this case? What access provider would we recommend?
Yes, I was thinking about these use cases after the recent sssd-users thread. The exact use-case that was described is very common so I think we should react.
For the AD provider, I think we might add one more configuration option "ad_access_filter" that, if set, would augment the AD access provider so that it first checks if the account is expired and if it's not, then proceed to check if the account matches the filter without having to configure the LDAP provider.
I envision a wiki page titled: "HOWTO/Selecting the best access control configuration for the SSSD AD provider". That should cover different use cases and give recommendations based on the use case.
I agree. So I think we should open two tickets -- one for the documentation and one for the option. Do you agree?
Yes, and the one for option should start with a design page on wiki extracting information from this thread.
New option: https://fedorahosted.org/sssd/ticket/2082
Documentation: https://fedorahosted.org/sssd/ticket/2083
I also realized I didn't answer your original question about the other access providers and how they relate to subdomains. I think the fact that the subdomain access provider didn't work was quite a special case, because the main problem was that in the SSSD, it's not really easy to call a method of one provider (AD) from other provider (simple). If the types of the access providers are the same, which is typically the case, then we can safely call requests to refresh subdomains etc.
QE actually even tests the IPA access provider (HBAC) for trusted users. _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
You lost me a bit. Is LDAP access provider going to do searches against global catalog or not? If against GC everything should be fine but AFAIU it should be on a different port 3268. http://technet.microsoft.com/en-us/library/cc728188%28v=ws.10%29.aspx If against LDAP then it will be just local and would not see subdomains so rules for users from subdomains would not work. So if you do:
access_provider = ldap ldap_access_order = filter, expire ldap_account_expire_policy = ad ldap_access_filter = memberOf=cn=admins,ou=groups,dc=example,dc=com ldap_sasl_mech = GSSAPI ldap_sasl_authid = CLIENT_SHORTNAME$@EXAMPLE.COM ldap_schema = ad
it will cover only root domain and not subdomains because there is no indication that the search should be against global catalog. What am I missing?
Hm, you're right, I was already thinking with the new option in mind. We need to accelerate the new option, then.
sssd-devel@lists.fedorahosted.org
-
Dmitri Pal -
Jakub Hrozek