The authentication mechanism (sssd) on my RedHat server adds the domain at the end of usernames which is causing a problem when trying to log into a UniData database. Currently what is getting passed is username@ad.domain.com but the db is looking for username. Is there any way to change this on the server?

Hi:

I had to read this to understand what you have going on.
https://access.redhat.com/documentat...-user-ids.html

Why it's done this way IMO is a bad idea:
Sorry I'm not good with server configuration basic's so you'll have to wait for a member with that experience.

Maybe read this section of SSSD and System Services to see if you can change/remove what's going on. OR try one of the topics under Using and Caching Credentials with SSSD.

https://access.redhat.com/documentat...ntication.html

I believe it is part of the Kerberos authentication process. By convention, the network domain name is also used as the Kerberos realm name. This uniquely identifies the user and prevents cross realm failures(ie attacks) and provides better distributed naming facilities. Even if the username is the same, it is made unique by the realm (or domain) name.

The db should accept the expanded name, though instead of specifying just the username, it may require having "username@domainname" form. I don't believe any of the characters are improper for most database systems.

What dabase are you using?

I'm using Rocket Unidata.

I don't see where there should be an issue. The sssd entry is a network identity, not a Linux/Unix login.

I suspect you will have to contact the vendor to get a solution to whatever the problem is.

I've put out a ticket with the vendor, just waiting to hear back.

In the manual page:

Was actually pretty simple. I modified the sssd file by putting in full_name_format = %1$s

Thanks guys!

Nice. Thanks for the update.

To summarize:

re_expression - Reading/Interpretting a user name
full_name_format - Writing/Printing a user name

https://access.redhat.com/documentat...-user-ids.html

1 members found this post helpful.

You're Welcome.

What string in the sssd file did you have to change?

Don't forget to mark your thread Solved:-

jpollard and szboardstretcher thanks for jumping in and helping.-

I just added this to the sssd.config file:
full_name_format = %1$s

Marked as solved too. Didn't even know that was an option

Thanks again guys!

Thanks for the clarification-

Happy Thanksgiving!

I had the exact same issue, where I needed to remove the "@domain.local" from the fully qualified name "UserID@domain.local".

Based on your posts, I added the "full_name_format = %1$s" entry to the file, and the "override_homedir = /home/%u" entry.

Between these 2 entries, it resolved the look and feel to what I wanted.

But, when I attempted to "sudo su -" to root, it now tells me that my logname is not in the /etc/sudoers file.

If I add my information to the sudoers file, the system sees my local ID and prompts me for my password.

But, the password fails, probably at the AD level, because AD is still trying to authenticate to the fully qualified name.

Any help or suggestions would be greatly appreciated.

JCF

I also can't sudo when I use "full_name_format = %1$s"

if I remove that line then I can sudo fine.

Anyone know the fix for this?
Thanks.