So I took a brand new user that I have never used in the system before (I checked that the entry was not in the compat tree) and just ran an "id" command on Solaris system. I then looked in the /var/log/dirsrv/slapd-<ipa domain>/access log file on the ipa server, for the query and from the log file, the query came in as all caps.
example: [~]$: id 831...@win.mydomin.com [~]$: cat /var/log/dirsrv/slapd-<ipa domain>/access |grep 831413 [30/May/2017:13:34:38.637498942 -0400] conn=94124 op=622 SRCH base="cn=users,cn=compat,dc=ipa,dc=mydomain,dc=com" scope=1 filter="(&(objectClass=posixAccount)(uid=831...@win.mydomin.com))" attrs="cn uid uidNumber gidNumber gecos description homeDirectory loginShell" [30/May/2017:13:34:38.651811322 -0400] conn=94124 op=622 RESULT err=0 tag=101 nentries=1 etime=0 However, the entry in the compat tree is all lowercase just like I reported. I can reproduce this easily. Robert Johnson On Tue, May 30, 2017 at 1:10 PM, Alexander Bokovoy <aboko...@redhat.com> wrote: > On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote: > >> Red Hat Enterprise Linux Server release 7.3 >> ipa-server-4.4.0-14.el7_3.4.x86_64 >> 389-ds-base-1.3.5.10-15.el7_3.x86_64 >> sssd-1.14.0-43.el7_3.11.x86_64 >> >> When looking at entries in the "cn=groups,cn=compat" tree, I noticed that >> the entries for windows groups have the realm portion of the group name in >> all caps. This is true for the comment, the dn and the cn. >> example: >> # domain us...@win.mydomain.com, groups, compat, ipa.mydomain.com >> dn: cn=domain us...@win.mydomain.com >> ,cn=groups,cn=compat,dc=ipa,dc=mydomain,dc=com >> memberUid: 123...@win.mydomain.com >> cn: domain us...@win.mydomain.com >> >> When I look at the entries in the "cn=users,cn=compat" tree, the realm >> portion of the user name is all lower case. Incidentally, these same user >> names are also all lowercase in the "memberUid" option on the groups >> above. >> example: >> # 123...@win.mydomain.com, users, compat, ipa.mydomain.com >> dn: uid=123...@win.mydomain.com,cn=users,cn=compat,dc=ipa,dc=myd >> omain,dc=com >> homeDirectory: /home/win.mydomain.com/123456 >> uid: 123...@win.mydomain.com >> >> Was this by design ? >> > Users and groups for AD users are inserted into the compat tree on > demand, when a request comes mentioning them via LDAP query. The name is > taken from the LDAP query. > > So it is your application(s) that are asking fully qualified user/group > names with domain part capitalized. > > > The reason I ask, is that when I try to use the "kinit" feature on our >> Solaris 10 systems (which is joined to the IPA domain) for this windows >> user, I get an error. >> >> [~]$ kinit >> Password for 123...@win.mydomain.com: >> kinit(v5): KDC reply did not match expectations while getting initial >> credentials >> >> If I run it like this: >> [~]$ kinit 123...@win.mydomain.com >> Password for 123...@win.mydomain.com: >> [~]$ klist >> Ticket cache: FILE:/tmp/krb5cc_1683378846 >> Default principal: 123...@win.mydomain.com >> >> Valid starting Expires Service principal >> 05/30/17 11:44:35 05/30/17 21:44:40 krbtgt/ >> win.mydomain....@win.mydomain.com >> renew until 06/06/17 11:44:35 >> >> I believe this is due to the fact that the Solaris 10 system is using the >> lowercase entry in the compat tree above. Here is the result of the ID >> command on this user: >> [~]$ id >> uid=1683378846(123...@win.mydomain.com) gid=1683378846( >> 123...@win.mydomain.com) >> >> I know this is a work around but I would prefer to make this easier on the >> end users. Any suggestions ? >> > You mix up Kerberos principals and user identities. They are different. > In Kerberos protocol realm is case-sensitive. WIN.MYDOMAIN.COM is not > the same realm as win.mydomain.com. On Active Directory side this is > hidden behind the Windows UI facade but on UNIX systems Kerberos > libraries aren't hiding this fact. > > That's why you get "KDC reply did not match expectations .." error > message -- a realm name is used as part of Kerberos exchange and it is > expected to be all upper cases. > > On identity front you have probably configured your Solaris systems to > look up identities with upper cased fqdn and compat tree plugin inserts > those as it is. I certainly don't see this behavior with other systems. > > -- > / Alexander Bokovoy >
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org
