{"action":"created","issue":{"url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/181","repository_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi","labels_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/181/labels{/name}","comments_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/181/comments","events_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/181/events","html_url":"https://github.com/modauthgssapi/mod_auth_gssapi/issues/181","id":329506714,"node_id":"MDU6SXNzdWUzMjk1MDY3MTQ=","number":181,"title":"Issue with mismatched UPN/sAMAccountName","user":{"login":"mortenn","id":640095,"node_id":"MDQ6VXNlcjY0MDA5NQ==","avatar_url":"https://avatars0.githubusercontent.com/u/640095?v=4","gravatar_id":"","url":"https://api.github.com/users/mortenn","html_url":"https://github.com/mortenn","followers_url":"https://api.github.com/users/mortenn/followers","following_url":"https://api.github.com/users/mortenn/following{/other_user}","gists_url":"https://api.github.com/users/mortenn/gists{/gist_id}","starred_url":"https://api.github.com/users/mortenn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mortenn/subscriptions","organizations_url":"https://api.github.com/users/mortenn/orgs","repos_url":"https://api.github.com/users/mortenn/repos","events_url":"https://api.github.com/users/mortenn/events{/privacy}","received_events_url":"https://api.github.com/users/mortenn/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-06-05T15:21:56Z","updated_at":"2018-06-22T09:06:16Z","closed_at":"2018-06-21T10:21:18Z","author_association":"NONE","body":"Hi,\r\n\r\nDue to an ongoing migration to office 365, our UPNs and sAMAccountNames no longer match.\r\nThis has caused a small issue with one service, where we use gssapi in combination with ldap to do aaa;\r\n\r\n```\r\nAuthLDAPUrl \"ldaps://.../?userPrincipalName\"\r\nAuthLDAPBindDN \"...\"\r\nAuthLDAPBindPassword \"...\"\r\n\r\nAuthType GSSAPI\r\nGssapiBasicAuth Off\r\nGssapiSSLonly On\r\nGssapiUseSessions Off\r\nGssapiConnectionBound On\r\nGssapiAllowedMech krb5\r\nGssapiCredStore keytab:...\r\n\r\nrequire ldap-group CN=...\r\n```\r\n\r\nBefore I changed my UPN, this was working fine.\r\nI can see the sAMAccountName in the access logs, with @domain.com\r\nPreviously, this would match the upn.\r\n\r\nI've tried changing the LDAPUrl to ?sAMAccountName, but that didn't work.\r\nPresumably because the ldap auth gets passed MNI@DOMAIN.COM which will neither match the sAMAccountName nor the UPN.\r\n\r\nAny suggestions on how to fix this?"},"comment":{"url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/comments/399375394","html_url":"https://github.com/modauthgssapi/mod_auth_gssapi/issues/181#issuecomment-399375394","issue_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/181","id":399375394,"node_id":"MDEyOklzc3VlQ29tbWVudDM5OTM3NTM5NA==","user":{"login":"mortenn","id":640095,"node_id":"MDQ6VXNlcjY0MDA5NQ==","avatar_url":"https://avatars0.githubusercontent.com/u/640095?v=4","gravatar_id":"","url":"https://api.github.com/users/mortenn","html_url":"https://github.com/mortenn","followers_url":"https://api.github.com/users/mortenn/followers","following_url":"https://api.github.com/users/mortenn/following{/other_user}","gists_url":"https://api.github.com/users/mortenn/gists{/gist_id}","starred_url":"https://api.github.com/users/mortenn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mortenn/subscriptions","organizations_url":"https://api.github.com/users/mortenn/orgs","repos_url":"https://api.github.com/users/mortenn/repos","events_url":"https://api.github.com/users/mortenn/events{/privacy}","received_events_url":"https://api.github.com/users/mortenn/received_events","type":"User","site_admin":false},"created_at":"2018-06-22T09:06:16Z","updated_at":"2018-06-22T09:06:16Z","author_association":"NONE","body":"Still having this issue with another system where I've got sssd set up, as that makes the local name samaccountname@example.com But as the data being exposed on that server is less sensitive, I'm not terribly fussed if all internal users can access it."}}
{"actor":{"display_login":"mortenn"}}