diff options
| author | Sumit Bose <sbose@redhat.com> | 2013-12-09 11:45:28 +0100 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2013-12-18 15:33:12 +0100 |
| commit | 0324d31d0479e5de0d3aac05bf5fb922d84f84c4 (patch) | |
| tree | e35f2dd9fb5472b764ca8f350ddd9f82fb4b6074 /src/lib/idmap/sss_idmap.h | |
| parent | 81aa563090c33bafbf22f1cde586b77ed526c25f (diff) | |
| download | sssd-0324d31d0479e5de0d3aac05bf5fb922d84f84c4.tar.gz sssd-0324d31d0479e5de0d3aac05bf5fb922d84f84c4.tar.xz sssd-0324d31d0479e5de0d3aac05bf5fb922d84f84c4.zip | |
AD: use LDAP for group lookups
The group memberships cannot be reliable retrieved from the Global
Catalog. By default the memberOf attribute is not replicated to the GC
at all and the member attribute is copied from the local LDAP instance
to the GC running on the same host, but is only replicated to other GC
instances for groups with universal scope. Additionally the tokenGroups
attribute contains invalid SIDs when used with the GC for users from a
different domains than the GC belongs to.
As a result the requests which tries to resolve group-memberships of a
AD user have to go to a LDAP server from the domain of the user.
Fixes https://fedorahosted.org/sssd/ticket/2161 and
https://fedorahosted.org/sssd/ticket/2148 as a side-effect.
Diffstat (limited to 'src/lib/idmap/sss_idmap.h')
0 files changed, 0 insertions, 0 deletions