Linux – Get fullname by username using SSSD

Finally I was able to resolve it. This article helped me a lot.

Here is what I did. On SSSD side everything was configured fine, however, I did not configure the LDAP side. In order to Unix users (posix users) to work properly, we have to create posix groups and assign appropriate values.

For for each user, apart from assigning posix group ID and User ID, you need to attach them to a posix group as well. You can add this from 389 admin console as well. While creating group just click on the "posix group" section. Or from command prompt use this article

The reason why it's not working is because you're not specifying an actual filter. You have to understand what a "filter" is, according to LDAP and SSSD. Here's my own sssd.conf with the filters.

My LDAP access filter is saying if the person logging in has host=servername or host=ALL, they can access that machine.

[domain/default]

ldap_id_use_start_tls = True
cache_credentials = False
ldap_search_base = dc=example,dc=net?sub?|(host=palaceredirect.example.net)(host=ALL)
ldap_group_search_base = ou=Group,dc=example,dc=net
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
sudo_provider = ldap
ldap_uri = ldap://library.example.net
ldap_tls_cacertdir = /etc/openldap/cacerts
access_provider = ldap
ldap_access_filter = (|(host=palaceredirect.example.net)(host=ALL))
ldap_schema = rfc2307bis
enumerate = True
autofs_provider = ldap

[sssd]
config_file_version = 2
services = nss, pam, sudo, autofs

domains = default

[nss]

[pam]

[sudo]

[autofs]

You can ignore my search base. The point of that was to allow "enumerate = True" to work effectively for getent passwd.