Hi all,

I wonder if it's possible to get a little help/debugging with the config of my sssd.conf for nested group membership.

We're using LDAP (provided via an AD 2003 forest and the SFU schema) and Kerberos. It works fine with nss_ldap on RHEL and returns all groups a user is a memberOf.

The following msSFU attributes are used (although not populated for all users and groups):

#Users

msSFU30UidNumber

msSFU30GidNumber

msSFU30HomeDirectory

msSFU30LoginShell

#Group

msSFU30GidNumber

Our sssd.conf (sanitised) is the following:

[domain/default]

description = LDAP domain with AD server

id_provider = ldap

auth_provider = krb5

hpass_provider = krb5

cache_credentials = True

ldap_schema = rfc2307

ldap_id_use_start_tls = False

ldap_uri = ldap://SUB.DOMAIN.COM/

ldap_search_base = dc=SUB,dc=DOMAIN,dc=COM

ldap_default_bind_dn = BINDUSER@SUB

ldap_default_authtok_type = password

ldap_default_authtok = PASSWORD

ldap_user_object_class = user

ldap_user_search_base = OU=SITEUsers,DC=SUB,DC=DOMAIN,DC=COM

ldap_user_name = sAMAccountName

ldap_user_uid_number = msSFU30UidNumber

ldap_user_gid_number = msSFU30GidNumber

ldap_user_home_directory = msSFU30HomeDirectory

ldap_user_shell = msSFU30LoginShell

ldap_user_fullname = displayName

ldap_user_gecos = displayName

ldap_user_member_of = memberOf

ldap_group_search_base = OU=SITEGroups,DC=SUB,DC=DOMAIN,DC=COM

ldap_group_object_class = group

ldap_group_name = cn

ldap_group_gid_number = msSFU30GidNumber

ldap_force_upper_case_realm = True

ldap_tls_cacertdir = /etc/openldap/cacerts

krb5_kpasswd = DC1.SUB.DOMAIN.COM:749

krb5_realm = SUB.DOMAIN.COM

krb5_kdcip = DC1.SUB.DOMAIN.COM:88

debug_level=6

The  ldap_schema is set at rfc2307 since rfc2307bis does not appear to work at all when calling:

                getent group GROUP_NAME     ---- Returns blank

                getent passwd USER_NAME       ---- Returns all user attributes and the group entry (GID) msSFU30GidNumber but no group name

Setting ldap_group_member = member breaks the group name being looked up also on rfc2307 . A minimal configuration doesn't appear to help either.

I've attached 4  debug6 files (sanitised).

Two for rfc2307 and two for rfc2307bis - with and without the ldap_group_member being specified.

The Linux command ran was:

id THE_USER

I would have expected it to output two groups cbu (2004) and comp (2000) for THE_USER.

If anyone could shed some light onto why the specification of ldap_group_member is a problem and why nested groups aren't working what I need to do to make it do that'd be fantastic.

Thanks,

Chris.