freeipa

#6372 [RFE] allow managing prioritized list of trusted domains for unqualified ID resolution
Closed: fixed Opened by abbra.

Closed: fixed
Reopen Issue

To allow SSSD to support flat namespace of user and group names from trusted domains, FreeIPA needs to maintain an ordered list of trusted domains. This would allow setting priorities between domains in case there are users and groups with the same names in the trusted domains.

FreeIPA should provide a way to refer existing trusted domains and assign weights to them. SSSD then would fetch and build the list of trusted domains based on the their weights to allow a single flat namespace for user and group names (without qualifiers).

And such a list should probably be defined per ID View so that if there is a special set of hosts combined into a view you can define a list for them. This would match what people are used to with other vendors. If the value is not defined the one from the default ID View would be used. Just an thought...

SSSD counterpart: https://fedorahosted.org/sssd/ticket/3210

Metadata Update from @abbra:
- Issue assigned to someone
- Issue set to the milestone: 0.0 NEEDS_TRIAGE

Metadata Update from @pvoborni:
- Custom field affects_doc reset
- Custom field design adjusted to https://www.freeipa.org/page/V4/AD_User_Short_Names
- Custom field tester adjusted to wanted
- Issue close_status updated to: None

Metadata Update from @pvoborni:
- Custom field affects_doc reset
- Issue assigned to mbabinsk (was: someone)
- Issue set to the milestone: FreeIPA 4.5 (was: 0.0 NEEDS_TRIAGE)

Metadata Update from @mbabinsk:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/573

master:

  • 594c87daf873ceec0c0cf3464bcb1aadb9f2b92a Short name resolution: introduce the required schema
  • 1b5f56d15455b6019dd532cb9635fa2c44cb0022 ipaconfig: add the ability to manipulate domain resolution order
  • 544d66b7109300e570fb6849f0f9bab8020f3b66 idview: add domain_resolution_order attribute
  • 4e5e3eebb223b7f2760e21f22e42775982104b0d Re-use trust domain retrieval code in certmap validators

Leaving opened until webUI parts is pushed

master:

  • 2c194d793cd588d595c5ff639fbf5dac93e50e23 WebUI: Add support for management of user short name resolution

Metadata Update from @mbasti:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 1cdd5dee006426c996f67240b6cb2c1aa05e5168 idviews: correctly handle modification of non-existent view
Metadata
None
None
None
Low
https://github.com/freeipa/freeipa/pull/573
defect
Trusts
wanted
https://www.freeipa.org/page/V4/AD_User_Short_Names
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.