<div dir="ltr">Hi Josh,<div><br></div><div>I think that's exactly the problem though, how does one set POSIX attributes in AD from Linux guests?</div><div><br></div><div>The RedHat documentation has a big warning that the Microsoft IDMU has been deprecated.</div><div><br></div><div>>> <a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Windows_Integration_Guide/ex.sssd-ad-posix.html">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Windows_Integration_Guide/ex.sssd-ad-posix.html</a><br></div><div><br></div><div>Surely you're not suggesting manually editing the AD Schema...?</div><div><br></div><div>Also, another use case is ssh keys. I'm not even sure that IDMU has an option for "authorized_keys" (and FreeIPA doesn't seem to honor what's in .ssh/authorized keys... when that file exists I always get prompted for a password then access denied).</div><div><br></div><div>I'm sure there are other per-user level attributes that are required, home directory perhaps?, but the two big ones are shell and ssh keys. I can't be the only one who has a use case for managing these attributes for Active Directory users.</div><div><br></div><div>Thanks,</div><div>Jon A</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 4, 2016 at 1:30 PM, Baird, Josh <span dir="ltr"><<a href="mailto:jbaird@follett.com" target="_blank">jbaird@follett.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div lang="EN-US" link="blue" vlink="purple"> <div> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">For AD users, I believe you have two options.<u></u><u></u></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">1) Set the POSIX value on the user in AD for the shell<u></u><u></u></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">2) Set the following in your client's sssd.conf:<u></u><u></u></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">[nss]<u></u><u></u></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">override_shell = /bin/bash<u></u><u></u></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">This would obviously be global per IPA client.<u></u><u></u></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Josh<u></u><u></u></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p> <div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt"> <div> <div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in"> <p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:freeipa-users-bounces@redhat.com" target="_blank">freeipa-users-bounces@redhat.com</a> [mailto:<a href="mailto:freeipa-users-bounces@redhat.com" target="_blank">freeipa-users-bounces@redhat.com</a>] <b>On Behalf Of </b>Jon<br> <b>Sent:</b> Thursday, February 04, 2016 2:25 PM<br> <b>To:</b> <a href="mailto:freeipa-users@redhat.com" target="_blank">freeipa-users@redhat.com</a><br> <b>Subject:</b> [Freeipa-users] [freeipa-users] How to manage Linux attributes for AD users (e.g. how do I set a shell for an AD User)<u></u><u></u></span></p> </div> </div><div><div class="h5"> <p class="MsoNormal"><u></u> <u></u></p> <div> <p class="MsoNormal">Hello,<u></u><u></u></p> <div> <p class="MsoNormal"><u></u> <u></u></p> </div> <div> <p class="MsoNormal">How does one manage linux attributes for AD users. Primarily in my case, I'm looking to change the default shell to either Bash or KSH depending on the user.<u></u><u></u></p> </div> <div> <p class="MsoNormal"><u></u> <u></u></p> </div> <div> <p class="MsoNormal">I can create a .profile that either sources bash or ksh rcs... e.g.:<u></u><u></u></p> </div> <div> <p class="MsoNormal"><u></u> <u></u></p> </div> <div> <p class="MsoNormal">>> $ cat ~/.profile<u></u><u></u></p> </div> <div> <p class="MsoNormal">>> bash ./.bashrc<u></u><u></u></p> </div> <div> <p class="MsoNormal"><u></u> <u></u></p> </div> <div> <p class="MsoNormal">This is really less than ideal and just seems like the wrong way to do it, especially considering we have a tool like FreeIPA.<u></u><u></u></p> </div> <div> <p class="MsoNormal"><u></u> <u></u></p> </div> <div> <p class="MsoNormal">According to <a href="http://blogs.technet.com/b/activedirectoryua/archive/2015/01/25/identity-management-for-unix-idmu-is-deprecated-in-windows-server.aspx" target="_blank"> Microsoft</a>, they are no longer supporting Identity Management for Unix. Does FreeIPA honor the attributes set by IDMU? Even if it's deprecated, I suppose we could continue to use it... <u></u><u></u></p> </div> <div> <p class="MsoNormal">This <a href="https://www.redhat.com/archives/freeipa-users/2013-April/msg00007.html" target="_blank"> previous FreeIPA thread</a> seems to indicate you can force the shell for anyone in the domain logging into that machine, but we have some users who prefer one shell over the other.<u></u><u></u></p> </div> <div> <p class="MsoNormal"><u></u> <u></u></p> </div> <div> <p class="MsoNormal">I did what I believe to be standard, I created a security group in AD, added that group to a group an external group in FreeIPA, then made an internal group and added the external group as a member to the internal group. Unfortunately, this doesn't seem to expose any of the AD attributes for management. Or maybe I'm just misunderstanding...<u></u><u></u></p> </div> <div> <p class="MsoNormal"><u></u> <u></u></p> </div> <div> <p class="MsoNormal">Any thoughts? How are you managing individual AD user settings?<u></u><u></u></p> </div> <div> <p class="MsoNormal"><u></u> <u></u></p> </div> <div> <p class="MsoNormal">Thanks,<u></u><u></u></p> </div> <div> <p class="MsoNormal">Jon A<u></u><u></u></p> </div> <div> <p class="MsoNormal"><u></u> <u></u></p> </div> </div> </div></div></div> </div> </div> </blockquote></div><br></div>