This is easier said than done.

The problem is: how do you distinguish user 'foobar' in /etc/passwd from user 'foobar' coming down from ldap ? (And you may have multiple ldap servers you get users from)

Now, as done in winbind, we have plans to allow for omitting the domain qualifier on the default backend, although it is really not ideal.

If we can always fully qualify the user name then you do not risk username collisions.

The problem reflects into login managers, what user do you try to login if you pass "foobar" at the login prompt ?

Well I think there should be a default domain for a machine. If I setup nssldap now, I don't see domains being returned. The default domain should not have an extension, just like I don't need to kinit dwalsh@redhat.com, I only kinit dwalsh. I don't think you will make me specify my domain at login time, unless I am logging into a machine on a different domain. So UID owned by the default domain should not have the realm.

I can't imagine having to chown dwalsh@redhat.com:dwalsh@redhat.com foo

People will balk at this.

Yes as said we have plans to provide a default domain option.

Yet the question of what to do if a local user conflict with a domain user persist.

One way is to test if a domain user conflicts with a local user and filter out the domain user.
The problem is what do you do if the local user is added after the domain user have been in use for some time ?
Right now nss will just return the first user found in getpwnam() and just duplicate users in getpwent() (same for groups), I guess I will just have to do the same ... although it really sucks (NSS that is).

Simo.

Fields changed

owner: somebody => simo

Ok, forgot to close this ticket some time ago, we now have means to configure whether we want the user name fully qualified or not.

resolution: => fixed
status: new => closed

Fields changed

rhbz: => 0

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1051

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.