search for: ad_access_filt

...e directory users. Regards, Zach My current configuration is as follows: cat /etc/sssd/conf.d/100_ad.conf [domain/ad_domain] ad_server = dc1, dc2 ad_domain = DOMAIN.COM krb5_realm = DOMAIN.COM dyndns_update = false id_provider = ad auth_provider = ad access_provider = ad cache_credentials = True ad_access_filter = (uidNumber=*) ldap_id_mapping = False ldap_sudo_search_base = OU=Linux,DC=domain,DC=com debug_level = 8 [sssd] domains = ad_domain services = nss, sudo, pam config_file_version = 2 [nss] homedir_substring = /home vetoed_shells = /usr/local/bin/bash shell_fallback = /usr/bin/bash cat /etc/krb...

...accounts able to connect on every UNIX boxes. I don't know much SSSD but I expect you can define restriction about who can connect on a given system. Playing with local sssd.conf to refuse login for users in some group or accepting only connection if user is in some other group. It seems "ad_access_filter" option is the one to do that, this option is described in sssd-ad man page. Doing that you will nominative root accounts in AD and filters to avoid all your admins can log on all UNIX machines. Now perhaps I haven't understand your need. 2015-10-29 10:47 GMT+01:00 Davor Vusir <dav...

On 2015-10-29 09:52, Rowland Penny wrote: > On 29/10/15 08:34, Davor Vusir wrote: >> Hi all! >> >> We have got many delegations in our AD. To add a certain >> administrator group to the local Administrators group you can use GPO >> for Windowsservers. As Samba does not understand GPO I have initially >> used the "username map" feature to add a

...is as follows: > > cat /etc/sssd/conf.d/100_ad.conf > [domain/ad_domain] > ad_server = dc1, dc2 > ad_domain = DOMAIN.COM > krb5_realm = DOMAIN.COM > dyndns_update = false > id_provider = ad > auth_provider = ad > access_provider = ad > cache_credentials = True > ad_access_filter = (uidNumber=*) > ldap_id_mapping = False > ldap_sudo_search_base = OU=Linux,DC=domain,DC=com > debug_level = 8 > > [sssd] > domains = ad_domain > services = nss, sudo, pam > config_file_version = 2 > > [nss] > homedir_substring = /home > vetoed_shells = /usr/l...

..._ad.conf > > [domain/ad_domain] > > ad_server = dc1, dc2 > > ad_domain = DOMAIN.COM > > krb5_realm = DOMAIN.COM > > dyndns_update = false > > id_provider = ad > > auth_provider = ad > > access_provider = ad > > cache_credentials = True > > ad_access_filter = (uidNumber=*) > > ldap_id_mapping = False > > ldap_sudo_search_base = OU=Linux,DC=domain,DC=com > > debug_level = 8 > > > > [sssd] > > domains = ad_domain > > services = nss, sudo, pam > > config_file_version = 2 > > > > [nss] > &gt...