Bug 767724

Summary: Howto handle trusted domains with SfU or other RFC2307 attributes
Product: Red Hat Enterprise Linux 6 Reporter: Dmitri Pal <dpal>
Component: doc-Identity_Management_GuideAssignee: Deon Ballard <dlackey>
Status: CLOSED CURRENTRELEASE QA Contact: ecs-bugs
Severity: medium Docs Contact:
Priority: medium    
Version: 6.3CC: jskeoch, mkosek
Target Milestone: rcKeywords: Documentation
Target Release: 6.3   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-07-03 02:54:42 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Dmitri Pal 2011-12-14 18:35:30 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/1904

Currently we plan to map Windows SIDs to Unix UID algorithmic (ID range for each domain, RID is added to the lowest ID in the range). But how shall we handle trusted domains where RFC2307 like attributes are already available, e.g. with Services for Unix (SfU) or the IdM for Unix in newer AD versions.

On then one hand it would be irritating that a Windows user with a unix uid and gid will have a different uid and gid on a unix host.

On the other hand a trust relationship means to make all users and groups available. And here we will most certainly fail if not all users and groups in a domain have the RFC2307 attributes and we take those form some users and groups and calculate them for the rest.

So I think it would be better to not look at those attributes at all, but we have to underline this strongly in the documentation
Comment 1 Deon Ballard 2012-04-24 15:14:58 UTC 
I added a section here:
http://documentation-stage.bne.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/about-sync-schema.html#windows-rfc2307-attributes
Comment 3 Deon Ballard 2012-06-22 20:06:26 UTC 
Fixed:
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/about-sync-schema.html#windows-rfc2307-attributes