I have an AD environment with IDMU and specified
UID/GID for my domain users. SSSD-connected domain user does not share the same
UID/GID on Ubuntu as AD.
Here's the default unedited
sssd.conf in Ubuntu 20.10:
% sssd --version 2.3.1 # cat /etc/sssd/sssd.conf [sssd] domains = webtool.space config_file_version = 2 [domain/webtool.space] default_shell = /bin/bash krb5_store_password_if_offline = True cache_credentials = True krb5_realm = MYDOMAIN.SPACE realmd_tags = manages-system joined-with-adcli id_provider = ad fallback_homedir = /home/%u@%d ad_domain = mydomain.space use_fully_qualified_names = True ldap_id_mapping = True access_provider = ad
Auser has a
10001 and a
10001 I would expect that these numbers would persist across other platforms, correct?
But SSSD seems to allocate arbitrary
UID/GID with no correspondence with AD numbers. Here's a real-world example:
% su [email protected] Password: [email protected]@myhostname:~/$ id uid=397401108([email protected]) gid=397400512(domain [email protected]) groups=397400512(domain [email protected]), 397400513(domain [email protected]), 397400518(schema [email protected]), 397400519(enterprise [email protected]), 397400572(denied rodc password replication [email protected]), 397401109([email protected]), 397401112(vcsa [email protected]), 397404603([email protected]), 397407607([email protected])
Is there any way to prevent this behavior? I would like my
UID/GID to correspond with the values assigned on the domain controllers.
Thanks to stellar first answer, all that was required to make mapping 1-1 was stop SSSD service, delete the cache, change
UID/GID are the same as AD:
% id uid=10000(auser) gid=10001(administrators) groups=10001(administrators),3109([email protected]),10000(domain [email protected])
Now to figure out why I am missing some of the groups my user belongs to...