<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Hi all,<br></div><div><br data-mce-bogus="1"></div><div>I have a questions about IPA with AD forest trust. What I am trying to do is setup environment, where all informations about users are stored in one place - AD. I would like to read at least uid, home, shell and sshkey from AD.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>I have set up trust with this parameters: <br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div> ipa trust-add EXAMPLE.TT --type=ad --range-type=ipa-ad-trust-posix --admin=administrator<br></div><div><br data-mce-bogus="1"></div><div>[root@ipa1 ~]# ipa idrange-show EXAMPLE.TT_id_range<br> Range name: EXAMPLE.TT_id_range<br> First Posix ID of the range: 1392000000<br> Number of IDs in the range: 200000<br> Domain SID of the trusted domain: S-1-5-21-4123312533-990676102-3576722756<br> Range type: Active Directory trust range with POSIX attributes<br></div><div><br></div><div><br data-mce-bogus="1"></div><div>I have set attributes in AD for user@EXAMPLE.TT <br data-mce-bogus="1"></div><div> - uidNumber -10000<br data-mce-bogus="1"></div><div> - homeDirectory -/home/user<br data-mce-bogus="1"></div><div> - loginShell - /bin/bash <br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Trust itself works fine. I can do kinit with user@EXAMPLE.TT , I can run id and getent passwd user@example.tt and I can use user@example.tt for ssh. <br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Problem is, that I am not getting uid from AD but from idrange:<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>uid=1392001107(user@example.tt)<br></div><div><br data-mce-bogus="1"></div><div>Also I have tried to switch off id mapping in sssd.conf with ldap_id_mapping = true in sssd.conf but no luck.<br></div><div><br data-mce-bogus="1"></div><div>I know, that it is probably better to use ID views for this, but in our case we need to set centrally managed environment, where all users information are externally inserted to AD from HR system - included POSIX attributes and we need IPA to read them from AD. <br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>So my questions are:<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Is it possible to read user's POSIX attributes directly from AD - namely uid ?<br data-mce-bogus="1"></div><div>Which atributes can be stored in AD ? <br data-mce-bogus="1"></div><div>Am I doing something wrong ? <br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>my sssd.conf:<br data-mce-bogus="1"></div><div>[domain/a.example.tt]<br>debug_level = 5<br>cache_credentials = True<br>krb5_store_password_if_offline = True<br>ipa_domain = a.example.tt<br>id_provider = ipa<br>auth_provider = ipa<br>access_provider = ipa<br>ipa_hostname = ipa1.a.example.tt<br>chpass_provider = ipa<br>ipa_server = ipa1.a.example.tt<br>ipa_server_mode = True<br>ldap_tls_cacert = /etc/ipa/ca.crt<br>#ldap_id_mapping = true<br>#subdomain_inherit = ldap_user_principal<br>#ldap_user_principal = nosuchattribute<br><br>[sssd]<br>services = nss, sudo, pam, ssh<br>config_file_version = 2<br><br>domains = a.example.tt<br>[nss]<br>debug_level = 5<br>homedir_substring = /home<br>enum_cache_timeout = 2<br>entry_negative_timeout = 2<br><br><br>[pam]<br>debug_level = 5<br>[sudo]<br><br>[autofs]<br><br>[ssh]<br>debug_level = 4<br>[pac]<br><br>debug_level = 4<br>[ifp]<br></div><div><br data-mce-bogus="1"></div><div>Thanks,<br data-mce-bogus="1"></div><div data-marker="__SIG_PRE__"><div><strong>Jan </strong></div></div></div></body></html>