On Fri, Apr 15, 2016 at 08:01:06PM +0000, Brook, Andy [CRI] wrote:
> We’re trying to setup FreeIPA to be a good provider of UIDs and GIDs for our 
> mostly RHEL systems. Overall, that works great. The issue I’m running into is 
> that we need to have the same consistent UIDs and GIDs for our Isilon system 
> which serves up both CIFS and NFS. Each user of the Isilon needs to have a 
> UID so that the files are owned properly. The Isilon has a way of getting 
> information from both Active Directory and an associated LDAP server. It gets 
> its list of users and groups from AD, a list of users, UIDs, groups and GIDs 
> from LDAP, and combine accounts that are the same. i.e. ADTEST.LOCAL\abrook 
> and abrook from LDAP will the same user. However, FreeIPA will show abrook(as 
> it sees through the Trust relationship with ADTEST.LOCAL) as 
> abrook@adtest.local<mailto:abrook@adtest.local> instead of abrook, so the 
> Isilon will see them as distinct accounts and won’t merge the information in 
> them. I can’t, as far as I can tell right now, tell the Isilon to see users 
> with @adtest.local as the same user without the domain. I can tell the Isilon 
> to look at a different LDAP attribute as its username, but there is no 
> attribute that has only the username.
> I noticed in the documentation that if I were to do a sync with Active 
> Directory (which isn’t something I want to do), I would get the 
> ntDomainUserID attribute that is the same as the samAccountName. This doesn’t 
> happen with a trust. Is there a way to get that in place with a custom 
> attribute or pull more LDAP attributes from AD?
> Has anyone else run into a situation like this? If so, were you able to 
> rectify that? If so, how?
> We have a ticket open with EMC for the Isilon as well, but want to make sure 
> we’re coming at this from all the angles we can.

I'm sorry, but currently overriding the attribute names for AD trusted
domains is not possible. We are working to make it possible for the next
version, but it's a bit of a stretch goal already, so chances it won't
be ready only for the version after the next one.

What might perhaps help you is that starting with upstream SSSD 1.14
(upstream 7.3), it should be possible to configure SSSD to only print
the shortname and not qualify the users in trusted domains.

Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project

Reply via email to