Support for ID Override Templates #7924
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
|
Is it kind of "addition" to IPA-IPA trust support, and thus should go to sssd-2-9 as well? |
Contributor
Author
Yes, I added the label. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
justin-stephenson
force-pushed
the
id_override_templates_v4
branch
2 times, most recently
from
85945ee to
c719017
Compare
Member
|
Hi @justin-stephenson, |
justin-stephenson
force-pushed
the
id_override_templates_v4
branch
from
c719017 to
a60320b
Compare
Contributor
Author
Updated. |
aplopez
reviewed
Apr 22, 2025
Contributor
aplopez
left a comment
aplopez
left a comment
There was a problem hiding this comment.
Haven't finished yet, but I already have two comments that I can share.
justin-stephenson
force-pushed
the
id_override_templates_v4
branch
from
a60320b to
081dbcc
Compare
aplopez
reviewed
May 9, 2025
justin-stephenson
force-pushed
the
id_override_templates_v4
branch
2 times, most recently
from
b8dc7d1 to
2c001ce
Compare
aplopez
reviewed
May 15, 2025
justin-stephenson
force-pushed
the
id_override_templates_v4
branch
from
2c001ce to
1a4f2f8
Compare
sumit-bose
reviewed
Jun 11, 2025
sumit-bose
reviewed
Jun 11, 2025
alexey-tikhonov
added
Waiting for review
coverity
Contributor
|
Hi, I'm still fine with the current state, CI failures do not seem related. bye, |
alexey-tikhonov
added
coverity
justin-stephenson
force-pushed
the
id_override_templates_v4
branch
from
25fdd71 to
a6501f4
Compare
Retrieve ID override templates on subdomain
initialization. When overrides are checked
during IPA lookups, check for fallback template
values.
:relnote: SSSD now checks for existence of ID override templates
in an IPA provider configuration. ID override templates
supports overriding loginShell and homeDirectory values
for trusted AD, or upcoming IPA-IPA trusted users. This
behavior is enabled by default.
justin-stephenson
force-pushed
the
id_override_templates_v4
branch
from
a6501f4 to
520081c
Compare
alexey-tikhonov
added
coverity
Member
|
Note: Covscan is green. |
Member
|
All failed system tests are due to 'pylibsshext.errors.LibsshChannelException: Failed to open_session: [-2]' |
Member
|
Pushed PR: #7924
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add support for ID override templates for Trusted AD/IPA users.
Testing this PR can be done with https://copr.fedorainfracloud.org/coprs/abbra/wip-ipa-trust/ which contains FreeIPA ID override templates code, and SSSD build with these code changes.
=====================
Add functionality for SSSD to apply domain templates and global templates as fallback override values to trusted IDM and AD users.
Templates are only assigned loginShell and/or homeDirectory attribute values. On the FreeIPA server, templates are added to ID views (Default trust view, or other) and will be used as fallback in ID override lookups. ID override templates can be set for user home directory(SSSD ‘override_homedir’ template syntax), or default login shell.
Two types of templates will exist, domain templates and global templates. Allow specifying a template entry for trusted domain users.
=====================
Domain template can be added with:
# ipa idoverrideuser-add 'example_for_c1' '*' --template ipa2demo.test --homedir /home/%d/%u-DOMAIN --shell /bin/kshGlobal template can be added with:
# ipa idoverrideuser-add 'example_for_c1' '*' --global-template --homedir /home/%d/%u-GLOBAL --shell /bin/csh