diff --git a/doc/source/security/kubernetes/sssd-support-5fb6c4b0320b.rst b/doc/source/security/kubernetes/sssd-support-5fb6c4b0320b.rst index f1b046643..36642a904 100644 --- a/doc/source/security/kubernetes/sssd-support-5fb6c4b0320b.rst +++ b/doc/source/security/kubernetes/sssd-support-5fb6c4b0320b.rst @@ -203,15 +203,14 @@ Run ``getent group @`` to see the group and its members .. code-block:: none - getent passwd eng@ad.wad-server.com + getent group eng@ad.wad-server.com Remote SSH ---------- Once the |SSSD| is connected to the domain, a domain user can be used to |SSH| -to the |prod| host. If a user has the same user login name in multiple domains, -the domain name can be used to distinguish between the common name users. +to the |prod| host. .. code-block:: none @@ -284,15 +283,22 @@ Support of sudo users and local linux group membership (e.g. ``sys_protected``) in |prod| platform is done locally after |WAD| users have been discovered by |SSSD|. +.. note:: + + The user names discovered by |SSSD| are not fully qualified and therefore + users names should be unique across multiple domains. In the Linux platform + the commands that require a user name parameter should use ```` + and not ``@``. + For example: .. code-block:: none # To add the WAD-discovered user "pvtest1" to the group 'sudo' - sudo usermod -a -G sudo pvtest1@ad.wad-server.com + sudo usermod -a -G sudo pvtest1 # To add the WAD-discovered user "pvtest1" to the group 'sys_protected' - sudo usermod -a -G sys_protected pvtest1@ad.wad-server.com + sudo usermod -a -G sys_protected pvtest1 ------------------------------------------- Default Local OpenLDAP Domain Configuration