Bug 1018189 - authconfig / sssd.conf: "dns_discovery_domain" issue
Summary: authconfig / sssd.conf: "dns_discovery_domain" issue
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: authconfig
Version: 6.6
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Tomas Mraz
QA Contact: BaseOS QE Security Team
Depends On:
TreeView+ depends on / blocked
Reported: 2013-10-11 12:02 UTC by guillard
Modified: 2016-08-11 11:06 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2016-08-11 11:06:15 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description guillard 2013-10-11 12:02:37 UTC
Description of problem:
if sssd uses dns discovery to look for ldap servers, then
the DNS zone to query for ldap server is specified with
the parameter "dns_discovery_domain" in sssd.conf, and the
parameter "ldap_uri" should not be declared.

If "dns_discovery_domain" is specified in sssd.conf, then
the configuration script 'authconfig' should not insert an
"ldap_uri"in sssd.conf, which it does.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:

1. edit sssd.conf and declare a "dns_discovery_domain" domain

2. launch "authconfig" with apropriate flags: --ldapserver="ldap.example.com" --enableshadow  --enablesssd --enablesssdauth --enableldap --enableldapauth --updateall

3. "ldap_uri"

Actual results:

the following line has been added to sssd.conf :

ldap_uri = ldap.example.com

Expected results:

this line should not be inserted to sssd.conf

Additional info:

After tshark investigations, it sounds like when both "ldap_uri" and "dns_discovery_domain" are declared in sssd.conf, then sssd uses ldap servers declared in "ldap_uri" server rather than querying the dns to look for the relevant ldap server to work with.

Comment 1 Tomas Mraz 2013-10-11 12:10:16 UTC
Authconfig cannot recognize all the possible configuration options that sssd supports. Just do not use it at all, or use it just for pam configuration - that is use --enablesssd --enablesssdauth but not --enableldap and the ldapserver and related options.

Comment 2 guillard 2013-10-13 18:17:33 UTC
Hi Tomas,

I understand your point. I'm sure that I will be able to find a workaround.
However I beleived that authconfig should support some sort of "ldapdnsdiscovery" option.


Comment 4 Tomas Mraz 2016-08-11 11:06:15 UTC
I am sorry but we are not going to implement this feature at this time.

Note You need to log in before you can comment on or make changes to this bug.