local group membership for freeipa user

[John Ratliff]

I want my administrators to be part of the systemd-journal group so they 
can run journalctl. How can I make a group part of a local system group 
like this inside ipa so I don't have to add them to every group on every 
system?

Thanks.

[Jakub Hrozek]

On Sat, Feb 03, 2018 at 08:33:19PM -0500, John Ratliff via FreeIPA-users wrote:
>  I want my administrators to be part of the systemd-journal group so
> they can
>  run journalctl. How can I make a group part of a local system group like
>  this inside ipa so I don't have to add them to every group on every system? 
https://sourceware.org/glibc/wiki/Proposals/GroupMerging

https://sgallagh.wordpress.com/2016/01/28/remote-group-merging-for-fedora/

[John Ratliff]

On 2/4/2018 5:55 AM, Jakub Hrozek via FreeIPA-users wrote:
>  On Sat, Feb 03, 2018 at 08:33:19PM -0500, John Ratliff via
> FreeIPA-users wrote:
> > I want my administrators to be part of the systemd-journal group so they can
> > run journalctl. How can I make a group part of a local system group like
> > this inside ipa so I don't have to add them to every group on every system?
>  
>  https://sourceware.org/glibc/wiki/Proposals/GroupMerging
>  
>  https://sgallagh.wordpress.com/2016/01/28/remote-group-merging-for-fedora/
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>   
So it sounds like I just make a group in IPA with the same GID and 
glibc/NSS makes it go.

Thanks.

[Jakub Hrozek]

On Sun, Feb 04, 2018 at 10:17:17PM -0500, John Ratliff via FreeIPA-users wrote:
>  On 2/4/2018 5:55 AM, Jakub Hrozek via FreeIPA-users wrote:
>  > On Sat, Feb 03, 2018 at 08:33:19PM -0500, John Ratliff via FreeIPA-users wrote:
>  > > I want my administrators to be part of the systemd-journal group so they can
>  > > run journalctl. How can I make a group part of a local system group like
>  > > this inside ipa so I don't have to add them to every group on every
> system?
>  > 
>  > https://sourceware.org/glibc/wiki/Proposals/GroupMerging
>  > 
>  > https://sgallagh.wordpress.com/2016/01/28/remote-group-merging-for-fedora/
>  > _______________________________________________
>  > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  > 
>  
>  So it sounds like I just make a group in IPA with the same GID and glibc/NSS
>  makes it go. 
Yes, but note that the libc support is relatively recent.