RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 768168 - [RFE] Allow Constructing uid from Active Directory objectSid
Summary: [RFE] Allow Constructing uid from Active Directory objectSid
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: sssd
Version: 6.0
Hardware: Unspecified
OS: Unspecified
high
unspecified
Target Milestone: rc
: ---
Assignee: Jakub Hrozek
QA Contact: Kaushik Banerjee
URL:
Whiteboard:
Depends On:
Blocks: 736854 998474
TreeView+ depends on / blocked
 
Reported: 2011-12-15 22:25 UTC by Dmitri Pal
Modified: 2020-05-02 16:25 UTC (History)
4 users (show)

Fixed In Version: sssd-1.9.1-1.el6
Doc Type: Enhancement
Doc Text:
Cause: Some Active Directory deployments do not carry the POSIX attributes such as UID number at all. Consequence: In order to use accounts from Active Directory in a Linux environment, the AD administrators would have to enable a special Services for UNIX extenstion with older AD servers and assign UID and GID numbers. Change: A new ID mapping library was implemented in the SSSD. The ID mapping library is capable of automatically generating UNIX IDs from Windows Security Identifiers (SIDs) Result: The administrator is able to use Windows accounts easily in a UNIX environment.
Clone Of:
Environment:
Last Closed: 2013-02-21 09:34:48 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 2038 0 None None None 2020-05-02 16:25:18 UTC
Red Hat Product Errata RHSA-2013:0508 0 normal SHIPPED_LIVE Low: sssd security, bug fix and enhancement update 2013-02-20 21:30:10 UTC

Description Dmitri Pal 2011-12-15 22:25:15 UTC 
In Active Directory with no Identity Management for Unix Role Service enabled there is no uid attribute available but the user id could be constructed from objectSid. This is what winbind's idmap_rid(8) and nss-pam-ldapd do:

 http://www.samba.org/samba/docs/man/manpages-3/idmap_rid.8.html
 http://lists.arthurdejong.org/nss-pam-ldapd-users/2011/msg00213.html
 http://arthurdejong.org/viewvc/nss-pam-ldapd?view=revision&revision=1425

It would make using SSSD against AD easier if something like this would be available in SSSD, too.

https://fedorahosted.org/sssd/ticket/996
Comment 1 RHEL Program Management 2012-07-10 07:07:02 UTC 
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 2 RHEL Program Management 2012-07-11 02:03:16 UTC 
This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development.  This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4.
Comment 4 Kaushik Banerjee 2012-11-16 08:54:16 UTC 
Verified in version 1.9.2-13

Report from baker automation run:
[   PASS   ]      idmap_001 ldap provider
[   PASS   ]      idmap_002 ldap provider,idmapping=false
[   PASS   ]      idmap_003 ldap_idmap_range_size is more than the difference of max-min
[   PASS   ]      idmap_004 ldap_idmap_range_min is negative
[   PASS   ]      idmap_005 ldap_idmap_range_max or ldap_idmap_range_min is a very large
[   PASS   ]      idmap_006 All values are negative
[   PASS   ]      idmap_007 ldap_idmap_range_min is zero
[   PASS   ]      idmap_008 ldap_idmap_range_max is less than ldap_idmap_range_min
[   PASS   ]      idmap_009 ldap_idmap_default_domain_sid=junk
[   PASS   ]      idmap_010 ldap_idmap_default_domain_sid=<doesn't match the AD domain sid>
[   PASS   ]      idmap_011 ldap_idmap_default_domain_sid=<matches the AD domain sid>
[   PASS   ]      idmap_012 ldap_idmap_autorid_compat=true and ldap_idmap_default_domain_sid is not mentioned
[   PASS   ]      idmap_013 ldap_idmap_autorid_compat=true and and ldap_idmap_default_domain_sid is not matching the AD domain SID
Comment 5 errata-xmlrpc 2013-02-21 09:34:48 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0508.html
Note You need to log in before you can comment on or make changes to this bug.