Interesting. None of that has been our experience, but then we only have
about 45,000 people in our AD.
On 11/15/22 8:17 PM, Nico Kadel-Garcia wrote:
On Tue, Nov 15, 2022 at 7:17 AM 'Rowe, Walter P. (Fed)' via Ansible
Project<[email protected]> wrote:
Look at SSSD for joining your Linux machine to AD. We use it and find it very
reliable. It also enables use of smart card for SSH logins if your public keys
are populated in your AD user objects if you work in an environment that
requires smart card login (2-factor).
sssd has a lot of configuration issues and some very performance
issues. It works best with FreeIPA rather than Active Directory: it's
basically a Samba core with a FreeIPA body bolted on top of it, and it
does not scale to large AD environments. (Its insistence on
pre-caching the *entire* LDAP of the AD server and crashing if it
times out on that pre-load, is deadly for bulky, remote environments.)
For a very simple AD setup, it can work well. Be aware that it will
transform account names like "nkadel" in the "example.com" AD domain
to"[email protected]", except when it doesn't, and the account
management can get pretty funky if you don't want to use the long form
all the time. Also be prepared to overload the 2048 maximum
line-length limit in /etc/group with such account names if you're not
cautious, and has to be dealt with that way unless you do
considerable extra work, in the sssd.conf and elsewhere in ways that
upgrades to sssd tend to erase. If you have to use it, be prepared to
spend time tuning the sssd itself with Ansible and managing
credentials with which to register the ansible target hosts in AD.
Nico Kadel-Garia
Email:[email protected]
Walter
--
Walter Rowe, Division Chief
Infrastructure Services, OISM
Mobile: 202.355.4123
On Nov 15, 2022, at 12:39 AM, David Logan<[email protected]> wrote:
Hi Chris,
I use PowerBroker to provide this sort of functionality. This auths to AD and
when I show my groups at the command line, all AD and local groups are shown.
PowerBroker has the AD user id and this can be added to the group in /etc/group.
What are you trying to do?
Regards
David
On Tue, 15 Nov 2022 at 09:47, 'Chris Bidwell - NOAA Federal' via Ansible
Project<[email protected]> wrote:
Hi all,
Is there a way to add an AD user to a local linux group? the user function
doesn't work because it's only looking in /etc/passwd for this user.
--
You received this message because you are subscribed to the Google Groups "Ansible
Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/ansible-project/11e4ab9c-195c-af78-6a34-bfb8deb9c1e9%40gmail.com.
