[SSSD-users] Re: [RFC] What would you like to see on sssd.io

[Paweł Szafer]

I think you got it right.

For PAM.D full file with specific info that this would work in Fedora only
would be ok.
While ago (3-4 years maybe) I copied config from Redhat docs in Centos for
SSSD and I found out month later that with config which I just copy/paste
from those docs login with AD is working just fine, but pam.d would allow
to login AD user with just simple [Enter]/blank password. Then I couldn't
reproduce it on Fedora and Arch and somehow fixed it easy.

I think the menu item List of Design Pages would be good enough.
Also I'd rename menu title "Learn" to simple "Docs" or
"Documentation", so
it would be consistent with page url https://sssd.io/docs/introduction.html
and left submenu title.

-----
Pawel



pt., 14 maj 2021 o 13:23 Pavel Březina <pbrezina(a)redhat.com&gt; napisał(a):

>  I read it as:
>
>  - Configuring automount with Kereberos authentication and more automount
>  information.
>  - Using trusted domains with non-qualified names (shortnames).
>  - How auto-discovery of trusted domains works.
>  - How auto-discovery of AD site works.
>
>  Correct me if I'm wrong. Also I added some more comments bellow.
>
>  On 5/13/21 1:05 PM, Paweł Szafer wrote:
>  > Hi,
>  >
>  > I'm coming from other OS - Arch Linux. So from my point of view:
>  >
>  >   * for NSS you pasted full config file and it is great
>  >
>  https://sssd.io/docs/ad/ad-provider-manual.html#nss-pam-configuration
>  >   * do the same for pam.d config so nobody gets confused
>
>  This is problematic, since pam config has little but important
>  differences between distributions (I remember a critical security issue
>  when some distro copy&pasted Fedora configuration).
>
>  We can provide sample config for Fedora since that's what we use but we
>  would like to rely on community to provide samples for other distributions.
>
>
>  >   * add info on which sssd/krb5 version it was tested, so it would be
>  >     easier to troubleshoot if there is too old or too new sssd
>
>  Ack.
>
>  >   * I'd like to see some manual how to properly configure automount with
>  >     AD with krb5 ticket authentication
>  >   * some extra info about systemd-automount, if possible, if would work
>  >     with DFS etc, as systemd-automount get's more popular (autofs was
>  >     for some reason removed from Arch repos :( )
>  >   * maybe what is possible to fetch with GPO for Linux (printers with
>  >     CUPS, shares with automount?), I read only this
>  >     https://sssd.io/design-pages/active_directory_gpo_integration.html
>  >   * more screenshots how to configure GPO, LDAP schema in Windows eg. I
>  >     see in man sssd-ad line "When the autofs provider is set to “ad”,
>  >     the RFC2307 schema attribute mapping (nisMap, nisObject, ...) is
>  >     used, because these attributes are included in the default Active
>  >     Directory schema.". It would be extra feature to read more on your
>  >     website with screenshots
>  >   * maybe PAM.D + AD configure of Smartcard implementation
>  >   * I can't find myself in menu schema. I googled this site:
>  >     https://sssd.io/design-pages/autofs_integration.html ; I have no
>  >     idea how to get there if coming from htttps://sssd.io <
>  http://sssd.io>
>
>  Would it help if "List of Design Pages" is highlighted in this case?
>
>  > Anyway, nowadays SSSD has great docs anyway! Thanks for your work!
>
>  Thanks for the feedback.
>
>  >
>  > -----
>  > Pawel
>  >
>  >
>  >
>  > śr., 12 maj 2021 o 23:15 Spike White <spikewhitetx(a)gmail.com
>  > <mailto:[e-mail]>> napisał(a):
>  >
>  >     Pavel,
>  >
>  >     To me, what was most helpful in the old documentation was the
>  >     architectural discussions embedded in the enhancement requests.
>  >     When the requests were satisfied.
>  >
>  >     Examples:
>  >           use of short names in non-local domains
>  >           auto-discovery of trusted domains
>  >
>  >     For instance, until I read that discussion I was unaware that if you
>  >     turned off auto-discovery and explicitly defined each child domain,
>  >     that sssd would no longer contact the global catalog (GC) and thus,
>  >     full membership in universal groups was not found.  Only if you
>  >     turned on auto-discovery did the sssd code query the GC.  this is
>  >     not intuitive, so having that documentation was a great help.
>  >
>  >     Another example is the discussion of that better discovery algorithm
>  >     for AD DCs.   It came out in a recent sssd release, maybe in the
>  >     last 6-9 months.   But I can't find that algorithm discussion now.
>  >
>  >     Spike
>  >
>  >     On Wed, May 12, 2021 at 7:15 AM Pavel Březina <pbrezina(a)redhat.com
>  >     <mailto:[e-mail]>> wrote:
>  >
>  >         Dear SSSD community,
>  >         we have recently introduced new SSSD project web page at
>  >         https://sssd.io. We would like to keep adding new content, we
>  have
>  >         plenty of ideas but we would also like to get some tips from you:
>  >
>  >         What articles would you like to see on the page? What knowledge
>  >         gaps are
>  >         hard to fill with existing documentation? Feel free to suggest
>  >         both user
>  >         and developer facing content.
>  >
>  >         Thanks,
>  >         Pavel
>  >         _______________________________________________
>  >         sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  >         <mailto:[e-mail]>
>  >         To unsubscribe send an email to
>  >         sssd-users-leave(a)lists.fedorahosted.org
>  >         <mailto:[e-mail]>
>  >         Fedora Code of Conduct:
>  >         https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  >         List Guidelines:
>  >         https://fedoraproject.org/wiki/Mailing_list_guidelines
>  >         List Archives:
>  >
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  >         Do not reply to spam on the list, report it:
>  >         https://pagure.io/fedora-infrastructure
>  >
>  >     _______________________________________________
>  >     sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  >     <mailto:[e-mail]>
>  >     To unsubscribe send an email to
>  >     sssd-users-leave(a)lists.fedorahosted.org
>  >     <mailto:[e-mail]>
>  >     Fedora Code of Conduct:
>  >     https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  >     List Guidelines:
>  https://fedoraproject.org/wiki/Mailing_list_guidelines
>  >     List Archives:
>  >
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  >     Do not reply to spam on the list, report it:
>  >     https://pagure.io/fedora-infrastructure
>  >
>  >
>  > _______________________________________________
>  > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  > Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  > Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>  >
>
>