SSSD / sssd

#2223 userPrincipalName should not be trusted by default for AD
Closed: Duplicate Opened by prefect.

Closed: Duplicate
Reopen Issue

userPrincipalName in active directory can actually be any string the admins want, and doesn't necessarily map to a kerberos user principal name. So using this attribute by default in an AD setting seems unwise.

In my case, it may contain {{{user@domain}}} even though the kerberos principal would be {{{user@sub.domain}}}, so SSSD's idea of what the UPN is will end up being wrong.

It's probably safer to default to not querying ldap for this attribute, and assuming {{{user@REALM}}} works, as this implicit userPrincipalName will always be understood by active directory, as opposed to the explicit UPN set in this attribute.

Hi,

we believe that your case would be solved by the enterprise principals feature of 1.11. Currently we build nightlies for several platforms:
http://jdennis.fedorapeople.org/ipa-devel/

Or you can use the repo we announced recently with (much more stable) 1.11 branch:
http://copr-fe.cloud.fedoraproject.org/coprs/jhrozek/SSSD-1.11-RHEL6/

Hi John, any luck trying out the 1.11 prerelease packages?

We believe the requested functionality is provided by the enterprise principals feature of 1.11 and later. Kindly reopen if it's not the case. Thanks for reporting the issue!

Closing as duplicate of ticket #1842.

resolution: => duplicate
status: new => closed

Metadata Update from @prefect:
- Issue set to the milestone: NEEDS_TRIAGE

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3265

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
High
enhancement
SSSD
1.11.3
None
None
None
None
0
0
0
0
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.