Bug 1285090 - Better documentation is needed for IMU and the impending deprecation in Win AD; concerning how POSIX attributes and mapping will be handled.
Better documentation is needed for IMU and the impending deprecation in Win A...
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: doc-Windows_Integration_Guide (Show other bugs)
7.1
x86_64 Linux
high Severity medium
: rc
: ---
Assigned To: Aneta Šteflová Petrová
Kaushik Banerjee
: Documentation
: 1207955 (view as bug list)
Depends On: 1435236
Blocks:
  Show dependency treegraph
 
Reported: 2015-11-24 16:05 EST by Amy Farley
Modified: 2017-08-08 10:04 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-08-08 10:04:34 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Amy Farley 2015-11-24 16:05:58 EST
The Windows Integration Guide needs to be amended to address the concerns of what effects the impending IMU deprecation in W2012r2 and W2016 will have on the integration of clients with POSIX attributes.

-------------------------8<-------------------------------------------------------------------------------------------- 

from comments #8 and #9 in the referenced case:

C#8 

Good afternoon.

I have been researching your questions and the quick answer is that sssd will do what you want and nfs4 will be happy as it maps by name not but uid/gid.

In Windows Server 2016, 

    "All IDMU-related features will go away, including UNIX Attributes tab. This also applies to Network Information Service (NIS) Server feature and the IDMU tools included with Remote Server Administration Tools (RSAT). Instead of IDMU/NIS server, you should use native LDAP, Samba Client, Kerberos, or non-Microsoft options. For Network File System (NFS), there is a Windows PowerShell cmdlet that allows you to update the user account with uid/gid: Set-NfsMappedIdentity.

In the future, if you try upgrade a computer that runs IDMU components, the upgrade will stop and you will be prompted to remove IDMU as explained at Installing or removing Identity Management for UNIX by using a command line."

from http://blogs.technet.com/b/activedirectoryua/archive/2015/01/25/identity-management-for-unix-idmu-is-deprecated-in-windows-server.aspx

But in RHEL sssd integrates with AD in this way:

    "ID mapping in SSSD can create a map between Active Directory security IDs (SIDs) and the generated UIDs on Linux. ID mapping is the simplest option for most environments because it requires no additional packages or configuration on Active Directory.

Unix services can manage POSIX attributes on Windows user and group entries. This requires more configuration and information within the Active Directory environment, but it provides more administrative control over the specific UID/GID values and other POSIX attributes.

Active Directory can replicate user entries and attributes from its local directory into a global catalog, which makes the information available to other domains within the forest. Performance-wise, the global catalog replication is the recommended way for SSSD to get information about users and groups, so that SSSD has access to all user data for all domains within the topology. As a result, SSSD can be used by applications which need to query the Active Directory global catalog for user or group information."

From https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Windows_Integration_Guide/sssd-ad-integration.html
-------------------------8<-------------------------------------------------------------------------------------------- 
and C#9

I utilized the same documents that you referenced to form my -assumptions- about this configuration. I am now looking for Red Hat official recommendation on how to proceed in the absence of IDMU but still [ideally] using POSIX attributes in AD.  It may be helpful to expound upon: 

"Unix services can manage POSIX attributes on Windows user and group entries. This requires more configuration and information within the Active Directory environment, but it provides more administrative control over the specific UID/GID values and other POSIX attributes."

Can someone fill in the details of the "more configuration and information within the Active Directory environment?"
-------------------------8<-------------------------------------------------------------------------------------------- 

More information is needed to address integration without the IMU.
Comment 5 Aneta Šteflová Petrová 2016-11-29 08:26:29 EST
*** Bug 1207955 has been marked as a duplicate of this bug. ***
Comment 6 Aneta Šteflová Petrová 2017-01-03 11:31:57 EST
The updated content is pending review.
Comment 7 Aneta Šteflová Petrová 2017-05-09 03:18:31 EDT
I received feedback from Jakub. I'm implementing it.
Comment 8 Aneta Šteflová Petrová 2017-05-11 06:35:01 EDT
The SSSD content in the Windows Integration Guide got a facelift. We went through it and updated it with respect to the current functionality - including the deprecation of IMU. Therefore, I marking this BZ as resolved.

If we find any remaining issues (missing content or errors in the existing content), it will be best to handle them in new, separate BZs.
Comment 10 Aneta Šteflová Petrová 2017-08-08 10:04:34 EDT
The update is now available on the Customer Portal.

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Windows_Integration_Guide/index.html

Note You need to log in before you can comment on or make changes to this bug.