UNSOLVED
InsightIQ changing LDAP directory
I am configuring the InsightIQ interface to use LDAP authentication as described in the user guide. Originally I was point IIQ at me development active directory system after tweeking config to how I wanted it I changed the sssd.conf to use the production active directory environment.
The system now works with any account that was NOT tested with in development. If I view the sssd_AUTH.log file I see where the proxy user queries the the user data and receives a valid response. IIQ then proceeds to send the authentication credentials for my dev enviornment. Basicall the only difference the the AD domain name.
I am assuming the user credentials are cached somewhere on the IIQ machine but can find not docs on how to clear this cache. tried changing the sssd.conf settings as follows restarted iiq and sssd to no help.
[domain/default]
#cache_credentials = true
cache_credentials = false
[domain/AUTH]
# cache_credentials = true
cache_credentials = false
I believe my problem is the cache in sysdb but do not know how to clear this.
Has anyone cleared this or should I open an SR?
regards
Bryan
crklosterman
450 Posts
554
0
Posted December 11th, 2014 13:00
Newswabs,
A couple of options here. Assuming you're just tring to match samaccountname in AD to CN in LDAP, you can use: isi auth ads modify or isi auth ldap modify (or both) with the following options:
--normalize-users
Normalizes user name to lowercase before lookup.
--normalize-groups
Normalizes group name to lowercase before lookup.
Besides that for testing the match between the users, compare:
isi auth mapping token domain\\username
and:
isi auth mapping token username
You may need some user mapping rules, the goal would be to get the output of the 2 commands above for 1 user to match exactly, meaning the SID, UID, GID, and all supplemental groups map regardless of the protocol.
Chris Klosterman
Senior Solution Architect
+1.913.200.1483
EMC Isilon Offer & Enablement Team
For the caching issue, I recommend opening an SR.
For the case sensitivity issue:
The InsightIQ virtual appliance is using CentOS as our base operating system.
Using that knowledge to narrow your googling might help.
I don't have a rig at the moment to test out your config, but here are some ideas I found on the net.
When I search for "centos authentication with active directory ignore username case",
The 3rd hit give me:
http://www.techrockdo.com/linux/centos-authentication-with-sssd
This site mentions setting case_sensitive = false In the /etc/pam.d/system-auth-ac file.
That seems like an easy thing to test.
Th 2nd hit is:
http://www.techrockdo.com/linux/centos-6-authentication-to-active-directory-part-1
The 1st comment and response talked about why CentOS changes to this and a possible fix which requires writing code to "fix" all your accounts. A bit a scary route to take to me though.
Hope this helps.
newswabs
3 Posts
554
0
Posted December 11th, 2014 09:00
I have found today that the usernames are case sensitive for active directory authentication. Our active directory has been in existence one way or another since the mid 90's and usernames are mixed case throughout. some all upper, some all lower and some mixed. Basically it was dependent on the person that created it.
to that end, does anyone know how to configure active directory LDAP to be case insensitive?