12:41 p.m.
I want to map my freeipa users to local users on a particular server. I have read a few
sites that say to do sss_override. However I am running into a problem:
[andrew.meyer@server01 ~]$ sudo sss_override user-add andrew.meyer -n ameyer
Other than LOCAL view already exists in domain freeipa.local.
But I remember seeing this somewhere as well:group: files [SUCCESS=merge] sss
Will doing the merge satisfy what I want?
Thanks,Andrew
5:32 a.m.
On Tue, Jul 09, 2019 at 05:41:05PM +0000, Andrew Meyer via FreeIPA-users wrote:
I want to map my freeipa users to local users on a particular
server. I have read a few sites that say to do sss_override. However I am running into a
problem:
Hi,
do you mean 'to a local user' or 'to a local group'?
[andrew.meyer@server01 ~]$ sudo sss_override user-add andrew.meyer -n
ameyer
Other than LOCAL view already exists in domain freeipa.local.
With overrides you can e.g change the user name but you should make sure
that there is no collision with e.g. a local user name, because this
might give you unexpected results. Additional with FreeIPA you cannot
use the local 'sss_override' command but use have to define with
idoverride on the ipa server with 'ipa idoverrideuser-add ...'. If the
override should be valid for only a single IPA client you have to
created a dedicated idview first and apply the idview to the IPA client.
Please note that you cannot change the idview of IPA servers only of IPA
clients.
But I remember seeing this somewhere as well:group: files
[SUCCESS=merge] sss
Will doing the merge satisfy what I want?
If you want to add an IPA user to a local group is should be sufficient
to just add the IPA user name to the group in /etc/group.
HTH
bye,
Sumit
Thanks,Andrew
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
8:31 a.m.
What I ended up doing to deal with this was write a script that checks if
any local users exist on the IPA server. If they do then it updates the UID
and GID and user's homedir permissions to match what's in IPA.
Maybe not exactly what you're looking for but it worked for us as we
transitioned from local auth to FreeIPA. That and the consistent ID's are
nice.
8:42 a.m.
On Tue, Jul 30, 2019 at 09:31:25AM -0400, John Petrini via FreeIPA-users wrote:
What I ended up doing to deal with this was write a script that
checks if
any local users exist on the IPA server. If they do then it updates the UID
and GID and user's homedir permissions to match what's in IPA.
Maybe not exactly what you're looking for but it worked for us as we
transitioned from local auth to FreeIPA. That and the consistent ID's are
nice.
Hi,
then I just got confused by the word 'mapping' and your aim was to
replace the local users with IPA users.
bye,
Sumit
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
1757
days inactive
1778
days old
freeipa-users@lists.fedorahosted.org
3 comments
3 participants
participants (3)
-
Andrew Meyer -
John Petrini -
Sumit Bose