What is the correct way to turn off fully qualified names on a Ubuntu Active Directory (AD) client?

Question

When I first joined my PC running Ubuntu Studio 18.04 to an Active Directory (AD) domain, I opted for fully qualified names because the Ubuntu PC had local users with the same names as domain users. Now that I have things running satisfactorily with domain users, I have deleted the local users and would like to drop using fully qualified names. In /etc/ssd/sssd.conf, I changed:

use_fully_qualified_names = True

to

use_fully_qualified_names = False

This had the desired effect in that after logging in as a domain user:

printenv USER

now yields:

username

instead of

[email protected]

However, it has some nasty side effects:

1. Logged in domain users are missing several local group memberships which were evidently assigned automatically by PAM, such as: cdrom audio video plugdev users netdev ssh lpadmin scanner saned sambashare
2. Logged in domain users can no longer access some files and directories, because the domain users now belong to the group "domain users", whereas the resources belong to the group "domain [email protected]", to which the domain users previously belonged.

How can I cleanly turn off the use of fully qualified names?
Are there better workarounds for the above-mentioned side effects than manually editing the group memberships?

Answer 1

I encountered a similar issue on SSSD in OEL 8.4, and the theory of the solution should convert fairly well back to Ubuntu.

If you manually added those users to the listed local groups, you may need to edit the group definitions with vigr and vigr -s. The group definitions work by name, so it will be dependent on whether your user had a FQ name. If they happened automatically, something else may be going on. I wouldn't expect local groups to be on a domain user by default (but I could be wrong).

For the directories, if the ID mapping didn't change they should port over to the non-FQ names since I think file permissions are based on ID number, not name. But, if for some reason the ID number changed, you'll need to update the affected files with chown. This may be filesystem or network share specific.

An additional note for any that found this question looking to convert FQ names to non-FQ names: you may need to comment out the default_domain_suffix in your sssd.conf for the non-FQ names to take.