Cloned Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=767724
Currently we plan to map Windows SIDs to Unix UID algorithmic (ID range for each domain, RID is added to the lowest ID in the range). But how shall we handle trusted domains where RFC2307 like attributes are already available, e.g. with Services for Unix (SfU) or the IdM for Unix in newer AD versions.
On then one hand it would be irritating that a Windows user with a unix uid and gid will have a different uid and gid on a unix host.
On the other hand a trust relationship means to make all users and groups available. And here we will most certainly fail if not all users and groups in a domain have the RFC2307 attributes and we take those form some users and groups and calculate them for the rest.
So I think it would be better to not look at those attributes at all, but we have to underline this strongly in the documentation
We will not do this in the near future. E.g. these attributes are not transmitted in the PAC and may not be available under for all setup.
It should be made clear in the documentation that these attributes are currently not supported.
Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=767724
Added a section here: http://docs.fedoraproject.org/en-US/Fedora/16/html/FreeIPA_Guide/about-sync-schema.html#windows-rfc2307-attributes
Rename component.
Metadata Update from @sbose: - Issue assigned to elladeon - Issue set to the milestone: FreeIPA 3.0 Trust Effort - 2012/04
Login to comment on this ticket.