Currently all AD trust users have a primary group id equal to their user id. In some situations it is desired to have users' primary group be shared group. Perhaps the AD primary group functionality could be leveraged for this.
In the id-range objects the information if user private groups (UPGs) should be used with algorithmic mapping or not should be stored. If this should be done with a flag or with a new id-range type still has to be decided.
If the id-range is configured to not use UPGs the AD LDAP attribute primaryGroupID should be used to determine the primary group. This attribute is available in the PAC as well so it allows consistens setting of the primary group. Please note that the numerical value of the attribute is a RID and not a POSIX ID. So the group with the matching RID in the AD domain has to be lookup up to determine the POSIX GID of the primary group. But this matches what the AD UI does when setting the primary group.
Related SSSD ticket https://fedorahosted.org/sssd/ticket/3183
Metadata Update from @orion: - Issue assigned to someone - Issue set to the milestone: Future Releases
Hi,
imo this issues is solved by #8807 and I'm closing this ticket.
bye, Sumit
Metadata Update from @sbose: - Issue close_status updated to: duplicate - Issue status updated to: Closed (was: Open)
Login to comment on this ticket.