# Need help with mapping usernames

**URL:** <https://discourse.openondemand.org/t/need-help-with-mapping-usernames/3346>\
**Category:** Get Help\
**Created:** [March 12, 2024, 2:18pm UTC](https://discourse.openondemand.org/t/need-help-with-mapping-usernames/3346 "2024-03-12T14:18:53Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![rgas20](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/rgas20/32/309_2.png) [@rgas20](https://discourse.openondemand.org/u/rgas20)\
**Post date:** [March 12, 2024, 2:18pm UTC](https://discourse.openondemand.org/t/need-help-with-mapping-usernames/3346/1 "2024-03-12T14:18:53Z")

</div>

Hello,

We could use some advice on mapping usernames.

We have an OOD site that is being accessed by users in multiple domains. We have authentication set up with ADFS. ADFS passes the email address, and we want to map that email address to the .local FQDN. This is how our filesystem is set up and how we are distinguishing different users from different domains.

So for instance – [john.doe@university.edu](mailto:john.doe@university.edu) needs to map to [john.doe@univ.local](mailto:john.doe@univ.local). Then, [jane.doe@college.edu](mailto:jane.doe@college.edu) needs to map to [jane.doe@college.local](mailto:jane.doe@college.local). So on and so forth.

Please forgive the novice attempts, and maybe there’s a much easier way of doing this, but we’ve added the necessary domains to ad\_enabled\_domains in sssd.conf.

Also, we’ve created a user\_map\_cmd script that runs on startup, and it does the following: echo $1 | tr ‘[:upper:]’ ‘[:lower:]’ | sed ‘s/%40/@/’

Originally when we attempted to log in, the username got mapped in URL encoded format (%40 vs @) so we added the sed piece to change it to @.

After doing this, it seems we are pretty close, and we want to do exactly what this error message is telling us as far as mapping, but we can’t proceed past here:

```auto
Error -- Username ‘first.last@university.edu' is being mapped to ‘first.last@univ.local' in SSSD and they don't match.
Users with domain names cannot be mapped correctly. If 'first.last@univ.local' still has the domain in it you'll need to set SSSD's full_name_format to '%1$s'.
See https://github.com/OSC/ondemand/issues/1759 for more details.
Run 'nginx_stage --help' to see a full list of available command line options.

```

Adjusting the full\_name\_format in SSSD hasn’t seemed to help – yet- but we are far from experts and aren’t exactly sure what needs to go here.

Does anyone have a similar setup, and how are you getting it to work?

Many thanks!

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [March 13, 2024, 1:36pm UTC](https://discourse.openondemand.org/t/need-help-with-mapping-usernames/3346/2 "2024-03-13T13:36:58Z")

</div>

> [@rgas20](#):
>
> Adjusting the full\_name\_format in SSSD hasn’t seemed to help – yet- but we are far from experts and aren’t exactly sure what needs to go here.

Just to be sure, you’re `full_name_format` is set to `%1$s`? I also assume that it’s in the `[sssd]` section. I am not entirely sure if you should have it in a different section or not. I’m also far from an SSSD expert.

I recall fixing that bug and adding that error message. You could edit the file that’s throwing the error (so that it doesn’t throw the error), but I seem to recall you having issues with sockets as well (if you look at the github ticket listed there - they also have issues booting a PUN but not being able to access the socket. IIRC you had a similar issue).

Here’s a little ruby one liner to test what values we’re seeing. As you can see my username `johrstrom` resolves directly to `johrstrom`. It would seem that you need to get `first.last` to remove the domain name.

```auto
[~()] ruby -e "require 'etc'; puts Etc.getpwnam('johrstrom')"
#<struct Etc::Passwd name="johrstrom", passwd="*", uid=30961, gid=5515, gecos="Jeff Ohrstrom", dir="/users/PZS0714/johrstrom", shell="/bin/bash">

```

Also - the actual users on the system are `first.last` without any domain at all? What shows up for them in the `name` field if you issue the ruby one liner here?

---

<div class="post-metadata">

**Author:** ![rgas20](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/rgas20/32/309_2.png) [@rgas20](https://discourse.openondemand.org/u/rgas20)\
**Post date:** [March 13, 2024, 3:29pm UTC](https://discourse.openondemand.org/t/need-help-with-mapping-usernames/3346/3 "2024-03-13T15:29:50Z")

</div>

Hi Jeff,

We don’t have the full\_name\_format set to %1$s, we got rid of that because it strips the domain name off of the end. In order for this to work with our setup, we’ll need OOD to map the user with the domain name included. So, it looks like by the error message above things are set up the way we need them to be - username first.last@university.edu maps to first.last@university.local - but OOD doesn’t let us proceed and tells us the usernames don’t match. Is there a way around that?

So for instance, this is what your one liner returns:

```auto
ruby -e "require 'etc'; puts Etc.getpwnam('first.last@domain.local')"
#<struct Etc::Passwd name="first.last@domain.local", passwd="*", uid=1997533168, gid=1997400513, gecos="First Last", dir="/home/domain.local/first.last", shell="/bin/bash">

```

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [March 13, 2024, 3:41pm UTC](https://discourse.openondemand.org/t/need-help-with-mapping-usernames/3346/4 "2024-03-13T15:41:24Z")

</div>

> [@rgas20](#):
>
> Also, we’ve created a user\_map\_cmd script that runs on startup, and it does the following: echo $1 | tr ‘[:upper:]’ ‘[:lower:]’ | sed ‘s/%40/@/’

OK - it sounds like your `user_map_cmd` needs to map `university.edu` → `university.local`. That is, it needs to map the domains as well as the username.

I wonder if something like this could work, though I’m sure you could combine the `sed` commands into 1 expression.

```auto
echo $1 | tr '[:upper:]' '[:lower:]' | sed 's/%40/@/' | sed 's/.edu/.local/'

```

---

<div class="post-metadata">

**Author:** ![rgas20](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/rgas20/32/309_2.png) [@rgas20](https://discourse.openondemand.org/u/rgas20)\
**Post date:** [March 13, 2024, 4:21pm UTC](https://discourse.openondemand.org/t/need-help-with-mapping-usernames/3346/5 "2024-03-13T16:21:46Z")

</div>

Ok, thanks! We’re working on something in user\_map\_cmd. Mainly, we were just wondering if we could get past this without editing user\_map\_cmd since it seems like the university.edu was being mapped to university.local correctly in the error message (but OOD didn’t like it). But if this is the only way, we have a script written up that we can use with user\_map\_cmd that we tested out a bit yesterday and I think we can get something working.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [March 13, 2024, 4:33pm UTC](https://discourse.openondemand.org/t/need-help-with-mapping-usernames/3346/6 "2024-03-13T16:33:01Z")

</div>

> [@rgas20](#):
>
> it seems like the university.edu was being mapped to university.local correctly in the error message (but OOD didn’t like it).

Did you see the ticket that error message related to? I did recall this correctly - you have this discourse topic for a similar error. I suspect that’s what’s causing these `Address already in use` errors - somehow the user can boot the PUN, but can’t actually access the socket as that user. And I suspect the reason is that they have different domains. I mean the user that started the PUN has one domain and somehow the user that’s trying to access the socket has a different domain and somehow SSSD/Linux is seeing those as distinct users.

Which is to say - OOD doesn’t like the different domains because I believe the different domains cause the `Address already in use` issue. So hopefully it fixes that for you as well! 🤞

> [@Issues with nginx error (98: Address already in use)](https://discourse.openondemand.org/t/issues-with-nginx-error-98-address-already-in-use/1627):
>
> All, I’ve seen some similar discussion on the topic but so far we haven’t been able to resolve this in our environment. A handful of our OnDemand users get this error every single time they log in: Error – /opt/ood/nginx\_stage/lib/nginx\_stage/views/pun\_config\_view.rb:110: warning: Using the last argument as keyword parameters is deprecated; maybe \*\* should be added to the call /opt/ood/nginx\_stage/lib/nginx\_stage/configuration.rb:244: warning: The called method `app\_config\_path’ is defined he…

> <https://github.com/OSC/ondemand/issues/1759>
>
> Dear All,
> Kindly help me resolve this issue below.
> I deployed a new open OnDeman…d system on our small redhat HPC cluster. the ood is running on centOS 7.9 configured with OnDemand-dex with freeipa IdM which integrate with Microsoft AD such that some users account are directly create on freeipa and others from the Microsoft AD. All users can ssh through ood node terminal to the cluster. 
> However, only the user login created in freeipa can login through ood web UI. 
> secondly, these successful logins also gives the error message below.
> 
> Error -- nginx: \[emerg\] bind() to unix:/var/run/ondemand-nginx/mftest@mendy.mrc.gm/passenger.sock failed (98: Address already in use)
> nginx: \[emerg\] bind() to unix:/var/run/ondemand-nginx/mftest@mendy.mrc.gm/passenger.sock failed (98: Address already in use)
> nginx: \[emerg\] bind() to unix:/var/run/ondemand-nginx/mftest@mendy.mrc.gm/passenger.sock failed (98: Address already in use)
> nginx: \[emerg\] bind() to unix:/var/run/ondemand-nginx/mftest@mendy.mrc.gm/passenger.sock failed (98: Address already in use)
> nginx: \[emerg\] bind() to unix:/var/run/ondemand-nginx/mftest@mendy.mrc.gm/passenger.sock failed (98: Address already in use)
> nginx: \[emerg\] still could not bind()
> 
> 
> 
> ┆Issue is synchronized with this \[Asana task\](https://app.asana.com/0/1201735133575781/1201737341353196) by \[Unito\](https://www.unito.io)

---

<div class="post-metadata">

**Author:** ![rgas20](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/rgas20/32/309_2.png) [@rgas20](https://discourse.openondemand.org/u/rgas20)\
**Post date:** [March 18, 2024, 2:15pm UTC](https://discourse.openondemand.org/t/need-help-with-mapping-usernames/3346/7 "2024-03-18T14:15:42Z")

</div>

Jeff, maybe a side note - how does SSSD play in once a user authenticates? This is a brand new OOD instance and we’re trying to configure SSSD in a way that handles the multiple domains. If we SSH to the server, we have SSSD configured in a manner that it places us directly where we need to go, regardless of the domain, no problem. But it seems that OOD ignores anything and everything we put in SSSD and the only way to manipulate how users are mapped or handled is via the optional user logon script (user\_map\_match or user\_map\_cmd). Is that expected behavior?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [March 18, 2024, 4:23pm UTC](https://discourse.openondemand.org/t/need-help-with-mapping-usernames/3346/8 "2024-03-18T16:23:43Z")

</div>

> [@rgas20](#):
>
> how does SSSD play in once a user authenticates?

OOD only really deals with strings. So if I authenticate with the user `aoakley` (the string that’s the result of any kind of user mapping), then we’ll tell Nginx to boot itself as that user.

Nginx then likley makes some system calls like `fork` and `setuid`, among lots of others likely, which I assume hits the SSSD stack, especially to figure out other group membership and where HOME is and so on.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [September 14, 2024, 4:23pm UTC](https://discourse.openondemand.org/t/need-help-with-mapping-usernames/3346/9 "2024-09-14T16:23:47Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.