I have an AD environment with IDMU and specified
UID/GID for my domain users. SSSD-connected domain user does not share the same
UID/GID on Ubuntu as AD.
Here's the default unedited
sssd.conf in Ubuntu 20.10:
% sssd --version 2.3.1 # cat /etc/sssd/sssd.conf [sssd] domains = webtool.space config_file_version = 2 [domain/webtool.space] default_shell = /bin/bash krb5_store_password_if_offline = True cache_credentials = True krb5_realm = MYDOMAIN.SPACE realmd_tags = manages-system joined-with-adcli id_provider = ad fallback_homedir = /home/%u@%d ad_domain = mydomain.space use_fully_qualified_names = True ldap_id_mapping = True access_provider = ad
Auser has a
10001 and a
10001 I would expect that these numbers would persist across other platforms, correct?
But SSSD seems to allocate arbitrary
UID/GID with no correspondence with AD numbers. Here's a real-world example:
% su firstname.lastname@example.org Password: email@example.com@myhostname:~/$ id uid=397401108(firstname.lastname@example.org) gid=397400512(domain email@example.com) groups=397400512(domain firstname.lastname@example.org), 397400513(domain email@example.com), 397400518(schema firstname.lastname@example.org), 397400519(enterprise email@example.com), 397400572(denied rodc password replication firstname.lastname@example.org), 397401109(email@example.com), 397401112(vcsa firstname.lastname@example.org), 397404603(email@example.com), 397407607(firstname.lastname@example.org)
Is there any way to prevent this behavior? I would like my
UID/GID to correspond with the values assigned on the domain controllers.
Thanks to stellar first answer, all that was required to make mapping 1-1 was stop SSSD service, delete the cache, change
UID/GID are the same as AD:
% id uid=10000(auser) gid=10001(administrators) groups=10001(administrators),3109(email@example.com),10000(domain firstname.lastname@example.org)
Now to figure out why I am missing some of the groups my user belongs to...