Feature: Support overriding the home directory via a template

[adombeck]

SSSD supports the override_homedir option in sssd.conf to provide a template which is used to assemble the home directory that's used for a new user.

These are some of the substitutions it supports:

   %u
       login name

   %U
       UID number

   %d
       domain name

   %f
       fully qualified user name (user@domain)

So setting the option to /home/%u creates the home directory as /home/<user>.

Users requested that authd should support something similar in #884.

[adombeck]

We could add a new setting homedir to the [users] section in the broker config file which supports similar substitutions to the ones above.

I think this would be a nice feature, especially since multiple users reported issues with the @ in the home directory:

• Feature: short user and primary group names #508 (comment)
• User Home Directory #884 (reply in thread)
• Feature: Modified usernames #574 (comment)

If we add this new setting, we might want to deprecate the existing home_base_dir setting, because it doesn't add any additional functionality compared to the new setting. If both settings are specified, I think we should ignore the deprecated setting (and log a warning).

The "Support short usernames" issue (#508), which we also want to solve at some point, is related. On first glance, I don't see any issues with adding the homedir setting first and later solve #508. I think if a short_username option, which strips the domain name from the login name, is enabled we might want to change the default home directory to also only use the login name. The homedir setting could still be useful in that case, for example if admins want to create the home directories on a shared filesystem and have the domain portion of the fully qualified username in the path (e.g. /home/%d/%u).

[yarohenning]

@adombeck Thanks for opening this! ❤️
I highly appreciate this, as we can't use authd unless this feature is implemented. (@ in username and pathes is a no-go for us, and fully quailified usernames are a lot to type and annoying)

BTW, sssd has the option "use_fully_qualified_names". As in some of your mentioned issues and also in the discussion #884 there was the fear of ambiguous usernames, this option can be set to true for setups where this really might be an issue and otherwise to false. ;)

[3v1n0]

If we do want to go that route, also having support for more fancy replacements would be nice (like only-first item of a dot-separated email to get name.middle-name.surname@foo.bar to only use name)

The multi-user setup is the only situation where this could lead to troubles, but indeed they are solvable by a FCFS policy, in case of clashes.

[adombeck]

If we do want to go that route, also having support for more fancy replacements would be nice (like only-first item of a dot-separated email to get name.middle-name.surname@foo.bar to only use name)

The multi-user setup is the only situation where this could lead to troubles, but indeed they are solvable by a FCFS policy, in case of clashes.

Ah, I forgot to explain my thoughts on the collision problem. If we enforce that the template contains at least one of these three substitutions:

   %u
       login name

   %U
       UID number

   %f
       fully qualified user name (user@domain)

then we should effectively avoid any clashes between users with the same domain. I expect that the vast majority of our users only use a single domain for all usernames - those should be fine. In the case that there are users with different domains, I would indeed handle collisions simply by denying login if the home directory already exists and is owned by a different UID, and printing an error message where we advise admins to include the domain in the home directory, e.g. via /home/%d/%u or /home/%u_%d.

To avoid collisions between users of the same domain, I would prefer not supporting other replacements like the removal of a part of the username.

[jayjayseal]

This would be a great change for Entra as the mail address as a username....... is working (even with the extra @)
but at the same time in some cases very lengthy (45 char usernames for example).

[adombeck]

the mail address as a username....... is working (even with the extra @)
but at the same time in some cases very lengthy (45 char usernames for example)

Note that we also plan to support a separate setting for the domain so that the usernames don't include the domain anymore (see the proposal in #508 (comment)).