Thanks a lot Alexander Strange, I am almost sure I got no results earlier if I used uid=*xxxx* searches Users are perfectly found now.... both fully-qualified and wither other queries.
Honestly, it's a bit a missing feature (for my use cases!) that RFC2307bis draft 02 presentation is missing for AD users, on the other side it is a very nice accomplishment that both RFC2307 in compat and RFC2307bis in cn=accounts are available in FreeIPA. Its a perfect platform for Linux and suitable for Unix....Because IMO LDAP always has been a bit too complicated for system auth ;-) $ ldapsearch -Y GSSAPI -b cn=compat,dc=accnix,dc=infrabel,dc=be '(&(objectClass=posixAccount)(uid=*mcj*))' SASL/GSSAPI authentication started SASL username: [email protected] SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <cn=compat,dc=accnix,dc=infrabel,dc=be> with scope subtree # filter: (&(objectClass=posixAccount)(uid=*mcj*)) # requesting: ALL # # [email protected], users, compat, accnix.infrabel.be dn: [email protected] ,cn=users,cn=compat,dc=accnix,dc=infrabel,dc= be objectClass: posixAccount objectClass: ipaOverrideTarget objectClass: top gecos: x cn: x uidNumber: x gidNumber: x homeDirectory: /home/Accmsnet.railb.be/mcj7700 ipaAnchorUUID:: x uid: [email protected] Thx a lot! -- Pieter On Wed, Jul 4, 2018 at 7:22 AM Alexander Bokovoy <[email protected]> wrote: > On ke, 04 heinä 2018, Pieter Baele via FreeIPA-users wrote: > >Hi, > > > >On a test FreeIPA environment (4.5.0-22), a user is shown using the id > >command, so ID Override is working as well. > >id [email protected] > >uid=8028([email protected]) gid=4030(ucc) > >groups=4030(ucc),702800513(domain [email protected] > >),1318400009(ad_users) > > > >However this particular (AD) user is not shown using an ldapsearch in the > >compat > >ldapsearch -Y GSSAPI -b cn=compat,dc=accnix,dc=infrabel,dc=be > >'(&(objectClass=posixAccount)(uid=xxxx))' > > > ># extended LDIF > ># > ># LDAPv3 > ># base <cn=compat,dc=accnix,dc=infrabel,dc=be> with scope subtree > ># filter: (&(objectClass=posixAccount)(uid=mcj7700)) > Here uid is non-fully qualified. A trigger in the compat tree plugin is > built around using fully qualified user names for AD users, e.g. > ([email protected]). > > -- > / Alexander Bokovoy > Sr. Principal Software Engineer > Security / Identity Management Engineering > Red Hat Limited, Finland >
_______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected]/message/IJGUGRQN5UF3EHIJCNR4IPH3CT7T3RIW/
