Shell customization for SSSD users

We have a few RHEL7 boxes for developers, users are authenticated with SSSD against AD.
Each developer has his/her own Linux machine, all Linuxes are managed by Puppet.
Till now all users used BASH ("default_shell = /bin/bash").
Now we have a few users which want ZSH. Because we'd like to keep sssd.conf standard
on all linuxes, we  thought about use something like:

allowed_shells = /bin/zsh,/bin/bash
shell_fallback = /bin/bash

So if certain linux box has ZSH installed, user will get it; else it will use BASH.
We tried this config, and played with other shell-related config params - nothing work.
Users receive /bin/sh instead of bash and zsh.

Any ideas?

TIA, 
Vitaly

[John Hodrien]

On Mon, 27 Mar 2017, me(a)vitalykarasik.com wrote:

>  We have a few RHEL7 boxes for developers, users are authenticated
> with SSSD
>  against AD.
>  Each developer has his/her own Linux machine, all Linuxes are managed by
>  Puppet.  Till now all users used BASH ("default_shell = /bin/bash").  Now we
>  have a few users which want ZSH. Because we'd like to keep sssd.conf
>  standard on all linuxes, we  thought about use something like:
>
>  allowed_shells = /bin/zsh,/bin/bash
>  shell_fallback = /bin/bash
>
>  So if certain linux box has ZSH installed, user will get it; else it will
>  use BASH.  We tried this config, and played with other shell-related config
>  params - nothing work.  Users receive /bin/sh instead of bash and zsh.
>
>  Any ideas? 
If you want users to get the shell they want, then you need to set the shell
they want in Active Directory, and make sure SSSD is configured to look at the
right attribute.  Otherwise you may find it's reading a duff attribute, or
it's reading the right one but it contains /bin/sh.

If you're managing it by puppet, and you actually want the config you
describe, you could just set default_shell for the machines differently, so
it's set to zsh on some and bash on others.

jh

[Vitaly Karasik]

Dear All - sorry for offtopic, but I don't see a way to contact maillist admin.
As far as I see, This list archive page displays *full* senders' emails addresses for
most posts.
I suggest to tweak mailllist software for prevent that.

Regards
Vitaly

[Vitaly Karasik]

> If you want users to get the shell they want, then you need to set the
> shell
> they want in Active Directory, and make sure SSSD is configured to look at the
> right attribute 
I understand that it is the most elegant solution.
But because AD is not under my management  we prefer to admin this stuff using linux-side
configs.
For now we use "default_shell = /bin/bash" for all machines.

> If you're managing it by puppet, and you actually want the config
> you
> describe, you could just set default_shell for the machines differently, so
> it's set to zsh on some and bash on others. 
You're right again.
We just tried to  keep all sssd.conf standard and choose user's shell based on
availability of zsh.

thank you, Vitaly