We use Puppet to manage our Linux desktop machines and SSSD to authenticate our users against a central authentication system. Recently when setting up a few new machines we found that puppet was halting in the middle of installing software packages. The culprit was the kdm package, which tries to add a local 'kdm' user when recently a 'kdm' username was added to the central authority.
Normally I see this problem handled with a namespace-dividing mechanism (such as Windows domains), but my short time in Linux administration doesn't really help me figure out a good way to do this.
I can figure out maybe a few general ideas of how to fix this (in most elegant to least elegant):
- Figure out an good way to divide up system usernames from central usernames so such future conflicts won't be a problem.
- Use some flag for dpkg to force the kdm package to add a different username (or to use nobody).
- Force dpkg to add the user. This won't allow the user to login to our systems but there's a good possibility this won't be an issue anyway.
Of course, (2) and (3) don't fix the underlying issue, but if a solution in the vein of (1) is particularly damaging to our current setup, something like (2) or (3) may be more preferable.