AWS res documentation change
Summary
Updated image alt texts, added examples of common SSSD configuration parameters (enumerate and ldap_id_mapping), and fixed CloudWatch log path formatting.
Security assessment
The change adds documentation about SSSD security configuration options (enumerate and ldap_id_mapping) which impact user enumeration and ID mapping behaviors. However, there's no evidence this addresses a specific security vulnerability.
Diff
diff --git a/res/archive/release-minus-2/ug/active-directory-sync.md b/res/archive/release-minus-2/ug/active-directory-sync.md index dcf4846a0..2d028bb1c 100644 --- a//res/archive/release-minus-2/ug/active-directory-sync.md +++ b//res/archive/release-minus-2/ug/active-directory-sync.md @@ -13 +13 @@ All the CFN parameters related to Active Directory (AD) are optional during inst - + @@ -28 +28 @@ After the initial installation, administrators can view or edit the AD configura - + @@ -30 +30 @@ After the initial installation, administrators can view or edit the AD configura - + @@ -43 +43 @@ Administrators can filter the users or groups to sync using the **Users Filter** -Administrators can provide a dictionary of key-value pairs containing SSSD parameters and values to write to the `[domain_type/DOMAIN_NAME]` section of the SSSD config file on cluster instances. RES applies the SSSD updates automatically– it restarts the SSSD service on cluster instances and triggers the AD sync process. For a full description of the SSSD configuration file, see the Linux man pages for `SSSD`. +Administrators can provide a dictionary of key-value pairs containing SSSD parameters and values to write to the `[domain_type/DOMAIN_NAME]` section of the SSSD config file on cluster instances. RES applies the SSSD updates automatically– it restarts the SSSD service on cluster instances and triggers the AD sync process. @@ -45 +45,12 @@ Administrators can provide a dictionary of key-value pairs containing SSSD param - +Some common custom SSSD settings are: + + * `enumerate` \- Set to 'true' to cache all user and group entries from the directory service. Disabling this could add a short delay to users' first login. + + * `ldap_id_mapping` \- Set to 'true' to map LDAP/AD user and group IDs to local UIDs and GIDs on the Linux system. Enabling this can improve compatibility with existing POSIX scripts and applications. + + + + +For a full description of the SSSD configuration file, see the Linux man pages for `SSSD`. + + @@ -58 +69 @@ The following example enables debug level for SSSD logs: - + @@ -64 +75 @@ Navigate to the **Identity management** page, and choose the **Start AD Synchron - + @@ -68 +79 @@ To stop an ongoing AD sync, select the **Stop AD Synchronization** button in the - + @@ -72 +83 @@ You can also check the AD sync status and the latest sync time in the **Active D - + @@ -92 +103 @@ The Active Directory synchronization process has been moved from the Cluster Man - 5. Observe the logs of the running AD Sync task under **CloudWatch** → **Log Groups** → ``<environment-name>`/ad-sync`. You'll see logs from each of the running ECS tasks. Select the most recent to view the logs. + 5. Observe the logs of the running AD Sync task under **CloudWatch** → **Log Groups** → `/`<environment-name>`/ad-sync`. You'll see logs from each of the running ECS tasks. Select the most recent to view the logs.