On 11.07.2013 11:46, Jakub Hrozek wrote:
On Wed, Jul 10, 2013 at 10:08:23PM -0400, Simo Sorce wrote:
> On Wed, 2013-07-10 at 23:32 +0200, Jakub Hrozek wrote:
>> On Wed, Jul 10, 2013 at 06:00:25PM +0200, Mehmet Soysal wrote:
>>> Hi,
>>> i have a short question about how ldap lookups are done
>>> and if it is possible to modify them.
>>> At the moment i have a sssd(1.9.2) up and running fine with a ldapserver.
>>>
>>> If a user tries to login with his username (ex. jsmith)
>>> or by getent command (getent passwd jsmith),
>>> sssd creates a ldap query with "uid=username".
>>>
>>> I found this in the logs:
>>> [sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400): calling
>>> ldap_search_ext with [(&(uid=jsmith)(objectclass=posixAccount))] ...
>>>
>>> ldapsearch for this user (jsmith)
>>> [...]
>>> uid: jsmith
>>> description: 2560
>>> givenName: John
>>> objectClass: organizationalPerson
>>> objectClass: person
>>> objectClass: posixAccount
>>> objectClass: inetOrgPerson
>>> objectClass: top
>>> cn: johnsmith
>>> sn: something_else
>>> homeDirectory: /home/jsmith
>>> mail: john.smith(a)domain.tld
>>> uidNumber: 54321
>>> gidNumber: 12345
>>> [...]
>>>
>>> Is it possible to change the default ldap lookup from sssd, using for
>>> example "mail" or "cn" instead of uid ?
>>> So the ldap lookup which is created by sssd does not look like this:
>>> [(&(uid=jsmith)(objectclass=posixAccount))]
>>> It should look like this one:
>>> [(&(mail=jsmith)(objectclass=posixAccount))]
>>>
>>> Maybe with a conf option
>>> lookup_username_attr mail
>>> #default uid
>>> would to the job.
>>>
>>> Of Course this would fail in this situation, but a user could then login
>>> with his mailadress( john.smith(a)domain.tld )
>>> via ssh for example, and get his usuall unixaccount "jsmith"
>>>
>>> I don`t want a mapping or rewrite of the uid field.
>>> The unixaccount name should still be filled by the uid field from ldap
>>> entry.
>>>
>>> I tried
>>> ldap_user_name = mail
>>> but then the unix account names are mapped to the mail attribute.
>>>
>>> With a second "Domain Section" a user could use both "login
names" to login
>>> via ssh.
>>> His Unix Account "jsmith" and his mail adress
"john.smith(a)domain.tld".
>>>
>>>
>>> Maybe someone knows if this is possible or not.
> It's not possible atm, but you could open a RFE against sssd to
> implement it. We had request to 'login by email' before.
Right, feel free to open a RFE.
I can open an RFE.
Maybe there are more people which would be interested
in this kind of feature.
>>> Thanks in advance
>>> M.Soysal
>> Hi Mehmet,
>>
>> I can only think about one approach - as attributes in LDAP are
>> multivalued, you could create additional "uid" attribute value that
>> would contain the e-mail as well.
>>
>> Here is how the SSSD behaves wrt name attributes:
>> 1) if there is a single attribute value, just use it.
>> 2) if the attribute is multivalued
>> 2a) If the RDN value corresponds to one of the attribute values,
>> use it as the primary name and the others as "aliases".
>> 2b) If the RDN value doesn't match to any of name values, pick
>> the first one.
>> 3) Lookups match both name and alias
>>
>> So if you had a multivalued "uid" attribute that would contain both the
name
>> (uid=joe) and the e-mail (uid=joe(a)example.com) the name would be present
>> in RDN (uid=joe,ou=users,dc=example,dc=com) then SSSD would store
"joe"
>> as the primary name, joe(a)example.com as the alias and the NSS responder
>> would match on both "joe" and "joe(a)xample.com".
> I think this would cause you to get entries with multivalued RDNs
No, it works correctly, I actually tested it.
The user entry on the server looked like this (simplified):
dn: uid=foo,cn=users,cn=accounts,dc=ipa,dc=example,dc=com
uid: foo
uid: foobar
On the client, both "getent passwd foo" and "getent passwd
foobar" worked. The entry in cache looked like this:
dn: name=foo,cn=users,cn=ipa.example.com,cn=sysdb
name: foo
nameAlias: foobar
The catch I ran into is that the default FQDN format is the same as
e-mail format..
>> I can't think of a way that would not require changes on the server
>> side, sorry.
> There is a way that would require changes in SSSD :-)
With the mentioned option
"lookup_username_attr" this feature could be
solved client side,
and does not need to do changes on the serve. Changing this on server
side, would sometimes also cause
changes in the whole infrastructure for User Management.
> Simo.
Sure, but I assumed that changing an entry on the server is an easier way
for the user than waiting on unreleased code.
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
--
----------------------------------------------------------------------------
Mehmet Soysal
Scientific Computing and Services (SCS)
Karlsruher Institut für Technologie (KIT)
Steinbuch Centre for Computing (SCC)
Zirkel 2, Gebäude 20.21, Raum 206
D-76131 Karlsruhe
Tel. : +49 721 608-46347
Fax : +49 721 32550
Email: Mehmet.Soysal(a)kit.edu
WWW :
http://www.scc.kit.edu
KIT - Universität des Landes Baden-Württemberg und
nationales Forschungszentrum in der Helmholtz-Gemeinschaft