☰

Samba不对sssd用户进行反向映射

tag-icon • tag-icon samba active-directory kerberos sssd
Samba不对sssd用户进行反向映射

我已通过 SSSD 本机 AD 支持配置用户。但是，当我尝试访问共享时，它被映射为“Unix User\用户名@领域“ 代替 ”领域\用户名”。

我的SSD：

[sssd]
config_file_version = 2
domains = domain.com
services = nss, pam

[nss]

[pam]

[domain/domain.com]
cache_credentials = true
id_provider = ad
auth_provider = ad
access_provider = simple
default_shell = /bin/zsh
fallback_homedir = /home/%d/%u
simple_allow_users = [email protected]
use_fully_qualified_names = true
ldap_id_mapping = true
ldap_schema = ad
ldap_idmap_range_min = 100000
ldap_idmap_range_max = 2000100000
ldap_idmap_range_size = 200000000
ldap_idmap_default_domain = DOMAIN.COM
ignore_group_members = true

我的krb：

[libdefaults]
    default_realm     = DOMAIN.COM
    clockskew         = 300
    ticket_lifetime   = 1d
    forwardable       = true
    proxiable         = true
    dns_lookup_realm  = true
    dns_lookup_kdc    = true
    allow_weak_crypto = true

[realms]
    DOMAIN.COM = {
        default_domain = DOMAIN.COM
        auth_to_local = RULE:[1:$1@$0](^.*@DOMAIN.COM$)s/@DOMAIN.COM/@domain.com/
    }

[domain_realm]
    .kerberos.server = DOMAIN.COM
    .domain.com = DOMAIN.COM
    domain.com = DOMAIN.COM
    domain = DOMAIN.COM

[appdefaults]
    pam = {
        ticket_lifetime         = 1d
        renew_lifetime          = 1d
        forwardable             = true
        proxiable               = false
        retain_after_close      = false
        minimum_uid             = 0
        debug                   = false
    }

[logging]
    default      = FILE:/var/log/krb5libs.log
    kdc          = FILE:/var/log/kdc.log
    admin_server = FILE:/var/log/kadmind.log

我的桑巴：

[Global]
  netbios name = HOSTNAME
  workgroup = DOMAIN.COM
  realm = DOMAIN.COM
  server string = %h
  security = ads
  client signing = yes
  client use spnego = yes
  encrypt passwords = yes
  password server = pdc.domain.com
  kerberos method = system keytab
  dedicated keytab file = /etc/krb5.keytab

  idmap config * : backend = tdbsam

  preferred master = no
  dns proxy = no
  wins support = no

  inherit acls = Yes
  map acl inherit = Yes
  acl group control = yes

  load printers = no
  #debug level = 3
  use sendfile = no

  #log level = 10

  strict allocate = yes
  aio read size = 16384
  aio write size = 16384
  aio write behind = true
  socket options = TCP_NODELAY IPTOS_LOWDELAY

答案1

我需要将/usr/lib/libwbclient.so.*库指向/usr/lib/sssd/modules/libwbclient.so.*.我向 Gentoo 发送了一份错误报告以妥善处理它。

相关内容