mjhjmtu

I have a setup with RHEL 7.4 machines that connect to Active Directory (AD) running on a Windows Server 2016 Datacenter Edition. The Linux machines are in direct integration with the AD.

Since Identity Management for Unix (IDMU) & NIS Server Role is removed from this version of Windows, the solution is to use sssd to autogenerate UID and GID numbers.

I am not able to understand how the autogenerated GID will be mapped to the actual group on the Linux machine.

For example, if user john is a member of LinuxGroup in the AD and is logged in and that should be mapped to group localgrp on the Linux machine, how will this work out? How would he get linuxgrp privileges if the autogenerated GID is 500 but localgrp GID is 10 on the Linux machine?

To have only central management of users, we are not allowed to add users directly in Linux i.e. in /etc/passwd.

Thanks.

First, only the management console was removed from WS2016, but the UNIX schema is still there, I think it should still be accessible with e.g. ADSI edit. So you can still use the POSIX attributes, it's just harder to set them.

Second, the automatic ID mapping currently doesn't allow you to select any ranges manually. We're working on that upstream, but it won't be ready anytime soon and even then, you're probably not after setting a range, but rather setting the same mapping as you had before, 1:1.

So if you're going with the automatic ID mapping, you'd have to either chown the files or create per-machine overrides using the sss_override command line tool.