JNDIRealm expects to do the authentication process and load roles from LDAP. The application itself should validate access based on roles granted for the authenticated user.
Since changing legacy application was not an option we are validating user membership at user search.
In Active Directory it is possible to add another group as a member of a group to improve directory management.
To validate user membership in this case we must use LDAP_MATCHING_RULE_IN_CHAIN custom matching rule during the search process as described here.
To do so we have to change or membership (memberOf=CN=DEV_CRYPTO_DASHBOARD,OU=Crypto,OU=Example Applications Group,DC=example,DC=net) to (memberOf:1.2.840.113518.104.22.1681:=CN=DEV_CRYPTO_DASHBOARD,OU=Crypto,OU=Example Applications Group,DC=example,DC=net).
I few days ago I was helping a client to move some systems to run under Linux. They are quite used to Windows environments and they would like to have an environment where they could have a workflow similar to the one they have using Windows servers.
Windows 2016 Domain Controller
Windows 10 Workstations
Ubuntu 20.04 LTS (Focal Fossa) Application Server
Sudoers must be granted via Active Directory group
Log to Linux servers using Active Directory account
Ability to copy files from Windows workstations to Linux servers using Windows Explorer
Ability to use ACLs on Linux in similar way to how they are done in Windows
The realm discover command returns complete domain configuration and a list of packages that must be installed for the system to be enrolled in the domain.
sudo realm discover example.com
Ensure that all listed packages are also installed.
Join Active Directory (AD) domain
An AD administrative user account is required for integrating your Linux machine with Windows Active Directory domain. Check and confirm AD admin account and the password.
The realm join command will set up the local machine for use with a specified domain by configuring both the local system services and the entries in the identity domain. The command has a number of options which can be checked with:
sudo realm join -U Administrator example.com
Test your new configuration.
Edit /usr/share/pam-configs/mkhomedir and set Default: yes to get it enabled.
Name: Create home directory on login
Activate your configuration.
Ensure “activate mkhomedir” is selected, it should have [*]
Tune your setup
In my scenario I’ve decided to tune some things because I’m dealing with just one domain.
full_name_format = %1$s to show just username omitting domain name
use_fully_qualified_names = True removed to omit domain name
fallback_homedir = /home/%u to create homedirs with just username
default_domain_suffix = example.com to have a default domain since we are omitting it
Final version of /etc/sssd/sssd.conf:
domains = example.com
config_file_version = 2
services = nss, pam
default_domain_suffix = example.com
default_shell = /bin/bash
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = EXAMPLE.COM
realmd_tags = manages-system joined-with-adcli
id_provider = ad
fallback_homedir = /home/%u
ad_domain = example.com
# use_fully_qualified_names = True
ldap_id_mapping = True
access_provider = ad
full_name_format = %1$s
Whenever there is a change in sssd.conf, restart is required.
sudo systemctl restart sssd
Status should be running.
systemctl status sssd
If the integration is working, it should be possible to get an AD user info.
Even the error message being very clear of what was going on, I wasn’t expecting this behavior since it is not usual to mess around with system DLLs registrations.
After a server migration some CLR routines stopped working on the new server showing the following error.
Msg 6522, Level 16, State 1, Line 1
A .NET Framework error occurred during execution of user-defined routine or aggregate "MyUserRoutine":
System.IO.FileLoadException: Could not load file or assembly 'System.ServiceModel, Version=22.214.171.124, Culture=neutral, PublicKeyToken=b77a5c561934e089' or one of its dependencies. Assembly in host store has a different signature than assembly in GAC. (Exception from HRESULT: 0x80131050) See Microsoft Knowledge Base article 949080 for more information.
A few days ago I was talking to a friend of mine about how some days are busier at hospitals than others. I’ve been told that when we are at a full moon hospitals receive more woman to give birth.
I got puzzled by that statement and decided to check on it.
Getting some data
I was worried that it would be hard to get some info on births, since any medical relevant data are usually very expensive. At first, I tried to get it from IBGE (Brazilian entity responsible for census). No luck.
Then I decided that birth location should not be relevant since the moon would affect entire earth if it was the case. Searching on internet I found a dataset from SSA (EUA Social Security Administration) with birth amount by date from 2000 to 2014.
First I had to look how Lunar phase works, before reading about it I thought the place you were on Earth would affect what phase of the moon you would see. Wrong. Regardless where you are (Brazil, Canada, Japan, etc) you are going to see the same moon phase.
I was expecting to find a moon phase table easy over the web but I was wrong. I found some sites that does the math for you and give you the results but I was not in the mood to write a scraper for that. After some research I found an old Python code that does the math, but it was written in Python 2. I was expecting to be easy to convert it to Python 3 but part of math was related to Julian days and datetime library changed since Python 2.
Then, I hacked it to use jdcal and generated a table with moon phase from 2000 to 2014.
Since datasets are not that big I joined then on Excel using VLOOKUP. I’ve also added some extra columns like weekday, Excel date, day type (working day, weekend).
So I got all data needed to answer the question: Is moon cycle correlated to amount of births?
Just to get a glimpse on how the data plots. Curious pattern.
Looks like there is no correlation on moon cycle and birth amount.
What if only a full moon affect births? Well, lets compare means.
Null hypothesis: There is no difference between average of births in full moon and average of births in other phase of the moon.
P-Value greater than 0.05, so accept null hypothesis. There no statistical difference between those means.
I got puzzled by the biphasic pattern of the plot. I started to wonder if something else was affecting births or if there were some seasonality on the series.
Let’s plot data on time series.
As expected, too much data to see something. Scattering it would be better.
Way better. Also biphasic, something is going on. Next post I’m going to try to figure it out.
There is no significant evidence that full moons affect births, although looks like there is some pattern on this data.