SDS@hd/Access/ID-Mapping - Revision history

H Schumacher: 2. to 3. level caption

2024-11-28T23:49:46Z

2. to 3. level caption

← Older revision		Revision as of 01:49, 29 November 2024
Line 1:		Line 1:
	== SDS@hd ID-Mapping ==		=== SDS@hd ID-Mapping ===

	ID-Mapping allows you to map the uidNumbers/gidNumbers of SDS@hd accounts to more descriptive usernames.		ID-Mapping allows you to map the uidNumbers/gidNumbers of SDS@hd accounts to more descriptive usernames.
Line 17:		Line 17:
	If you don't need a [[SDS@hd/Access/NFS#Prerequisites\|machine keytab]], but you still need ID Mapping (e.g. for CIFS Mounts on linux), you can use your Servicepassword to [[SDS@hd/Access/NFS#automated_kerberos_tickets\|create a user keytab]] for LDAP authentication.		If you don't need a [[SDS@hd/Access/NFS#Prerequisites\|machine keytab]], but you still need ID Mapping (e.g. for CIFS Mounts on linux), you can use your Servicepassword to [[SDS@hd/Access/NFS#automated_kerberos_tickets\|create a user keytab]] for LDAP authentication.

	=== Example configuration of SSSD ===		==== Example configuration of SSSD ====

	The authentication to SDS@hd is done via kerberos.		The authentication to SDS@hd is done via kerberos.

S Richling: /* Example configuration of SSSD */

2023-08-17T08:18:07Z

Example configuration of SSSD

← Older revision		Revision as of 10:18, 17 August 2023
Line 56:		Line 56:
	full_name_format = %3$s\%1$s		full_name_format = %3$s\%1$s

	re_expression = (((?P<domain>[^\\]+)\\(?P<name>.+$))\|((?P<name>[^@]+)@(?P<domain>.+$)))		re_expression = (((?P<domain>[^\\]+)\\(?P<name>.+$))\|((?P<name>[^@]+)@(?P<domain>.+$))\|(?P<name>.+$))
	enumerate = false		enumerate = false
	</pre>		</pre>

S Richling: /* Example configuration of SSSD */

2022-08-19T16:18:58Z

Example configuration of SSSD

← Older revision		Revision as of 18:18, 19 August 2022
Line 21:		Line 21:
	The authentication to SDS@hd is done via kerberos.		The authentication to SDS@hd is done via kerberos.

	If you have setup a working [[~~Sds-hd_kerberos~~\|kerberos environment]], you have to install the needed packages for kerberos and SSSD, e.g:		If you have setup a working [[SDS@hd/Access/Kerberos\|kerberos environment]], you have to install the needed packages for kerberos and SSSD, e.g:

	* RedHat/CentOS:		* RedHat/CentOS:

S Richling: /* SDS@hd ID-Mapping */

2022-08-19T16:18:19Z

SDS@hd ID-Mapping

← Older revision		Revision as of 18:18, 19 August 2022
Line 15:		Line 15:


	If you don't need a [[~~Sds-hd_nfs~~#Prerequisites\|machine keytab]], but you still need ID Mapping (e.g. for CIFS Mounts on linux), you can use your Servicepassword to [[~~Sds-hd_nfs~~#automated_kerberos_tickets\|create a user keytab]] for LDAP authentication.		If you don't need a [[SDS@hd/Access/NFS#Prerequisites\|machine keytab]], but you still need ID Mapping (e.g. for CIFS Mounts on linux), you can use your Servicepassword to [[SDS@hd/Access/NFS#automated_kerberos_tickets\|create a user keytab]] for LDAP authentication.

	=== Example configuration of SSSD ===		=== Example configuration of SSSD ===

S Richling at 15:46, 19 August 2022

2022-08-19T15:46:58Z

@@ Line 1: / Line 1: @@
-== ID-Mapping ==
+== SDS@hd ID-Mapping ==
 ID-Mapping allows you to map the uidNumbers/gidNumbers of SDS@hd accounts to more descriptive usernames.
@@ Line 52: / Line 52: @@
             ldap_sasl_canonicalize = false
             krb5_canonicalize = false
 </pre>

S Richling at 15:16, 19 August 2022

2022-08-19T15:16:11Z

← Older revision		Revision as of 17:16, 19 August 2022
Line 52:		Line 52:
	ldap_sasl_canonicalize = false		ldap_sasl_canonicalize = false
	krb5_canonicalize = false		krb5_canonicalize = false
			</pre>

S Richling at 15:14, 19 August 2022

2022-08-19T15:14:28Z

← Older revision		Revision as of 17:14, 19 August 2022
Line 1:		Line 1:
			== ID-Mapping ==

	ID-Mapping allows you to map the uidNumbers/gidNumbers of SDS@hd accounts to more descriptive usernames.		ID-Mapping allows you to map the uidNumbers/gidNumbers of SDS@hd accounts to more descriptive usernames.

S Richling: Created page with "ID-Mapping allows you to map the uidNumbers/gidNumbers of SDS@hd accounts to more descriptive usernames. If ID-Mapping is not or not correct configured, the ownerships and p..."

2022-08-19T15:05:55Z

Created page with "ID-Mapping allows you to map the uidNumbers/gidNumbers of SDS@hd accounts to more descriptive usernames. If ID-Mapping is not or not correct configured, the ownerships and p..."

New page

ID-Mapping allows you to map the uidNumbers/gidNumbers of SDS@hd accounts to more descriptive usernames.

If ID-Mapping is not or not correct configured, the ownerships and permissions of files/folders you see in the filesystem, will be incorrect. This could be confusing for users, but nevertheless the permission checking is done correctly on serversite.

Because [https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/configuring_domains SSSD] is one of the standard tools and it supports more than one ldap/identity provider on a system, we are showing here an example configuration for this tool.

But of course you can use any other mechanism/tool to do the LDAP queries for ID Mapping if you want.
The connection to SDS@hd LDAP Server is authenticated with the kerberos keytab of your machine. You can use any tool which supports GSSAPI with kerberos for authentication with the following parameters:
* uri: ldap://bwservices.uni-heidelberg.de
* search_base: dc=bwservices,dc=uni-heidelberg.de,dc=de
* sasl mech: GSSAPI Authentication
* krb5 Realm: BWSERVICES.UNI-HEIDELBERG.DE

If you don't need a [[Sds-hd_nfs#Prerequisites|machine keytab]], but you still need ID Mapping (e.g. for CIFS Mounts on linux), you can use your Servicepassword to [[Sds-hd_nfs#automated_kerberos_tickets|create a user keytab]] for LDAP authentication.

=== Example configuration of SSSD ===

The authentication to SDS@hd is done via kerberos.

If you have setup a working [[Sds-hd_kerberos|kerberos environment]], you have to install the needed packages for kerberos and SSSD, e.g:

* RedHat/CentOS:
<pre>$ yum install sssd-client sssd-krb5 sssd-ldap</pre>
* debian/ubuntu:
<pre>$ apt install sssd sssd-krb5 sssd-ldap sssd-tools libnss-sss libsasl2-modules-gssapi-mit</pre>

If not existing, create a SSSD configuration file (/etc/sssd/sssd.conf) like this:
<pre>
[sssd]
domains = BWSERVICESAD
config_file_version = 2
services = nss

[domain/BWSERVICESAD]
id_provider = ldap
ldap_uri = ldap://bwservices.uni-heidelberg.de
ldap_search_base = dc=bwservices,dc=uni-heidelberg,dc=de
ldap_referrals = false

ldap_schema = ad
ldap_id_mapping = true
min_id = 2000

ldap_sasl_mech = GSSAPI
krb5_realm = BWSERVICES.UNI-HEIDELBERG.DE
ldap_sasl_authid = <HOSTNAME$ or Username>
ldap_krb5_keytab = <path_to_your_keytab>
krb5_server = bwservices.uni-heidelberg.de
ldap_sasl_canonicalize = false
krb5_canonicalize = false