Hi,
I am working on [1] LDAP provider doesn't show group member
There is one point what I am not able to understand clearly.
I prepared environment by:
ipa user-add --first=Test --last=User1 --email=u1@domain.sssd cmt_user_1 ipa group-add cmt_group_1 ipa group-add-member --users=cmt_user_1 cmt_group_1
And sssd.conf is attached. I used patch 0007 [2] to simpler grep of interesting messages. And I applied patches 0001 to 0006 (I am waiting for their push to master).
[1] https://fedorahosted.org/sssd/ticket/3186 [2] 0007-WIP-Debuging-of-attr-member-in-ldap-answer.patch
What I saw is:
# COMMAND ON CLIENT: [root@mirach sssd]# systemctl daemon-reload && sudo su -c "truncate -s0 /var/log/sssd/*.log" && sudo su -c "rm -f /var/lib/sss/db/*" && sudo su -c "rm -f /var/lib/sss/mc/*" && sudo systemctl restart sssd.service && getent group cmt_group_1 && grep '>>>' *.log
# There is user missing: cmt_group_1:*:1703800166:
# SSSD LOG: [sdap_get_generic_ext_step] (0x0400): >>> calling ldap_search_ext with [(&(cn=cmt_group_1)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))][cn=groups,cn=accounts,dc=beta]. [sdap_get_generic_ext_step] (0x1000): >>> Requesting attrs: [objectClass] [sdap_get_generic_ext_step] (0x1000): >>> Requesting attrs: [cn] [sdap_get_generic_ext_step] (0x1000): >>> Requesting attrs: [userPassword] [sdap_get_generic_ext_step] (0x1000): >>> Requesting attrs: [gidNumber] [sdap_get_generic_ext_step] (0x1000): >>> Requesting attrs: [member] [sdap_get_generic_ext_step] (0x1000): >>> Requesting attrs: [modifyTimestamp] [sdap_get_generic_ext_step] (0x1000): >>> Requesting attrs: [entryUSN] [sdap_parse_entry] (0x0080): >>> ----- filter map: [sdap_parse_entry] (0x0080): >>> [posixGroup] [sdap_parse_entry] (0x0080): >>> [(null)] [sdap_parse_entry] (0x0080): >>> [cn] [sdap_parse_entry] (0x0080): >>> [userPassword] [sdap_parse_entry] (0x0080): >>> [gidNumber] [sdap_parse_entry] (0x0080): >>> [member] [sdap_parse_entry] (0x0080): >>> [(null)] [sdap_parse_entry] (0x0080): >>> [(null)] [sdap_parse_entry] (0x0080): >>> [modifyTimestamp] [sdap_parse_entry] (0x0080): >>> [entryUSN] [sdap_parse_entry] (0x0080): >>> [(null)] [sdap_parse_entry] (0x0080): >>> [(null)] [sdap_parse_entry] (0x0080): >>> ----- attributes in ldap answer: [sdap_parse_entry] (0x0020): >>> [objectClass] [sdap_parse_entry] (0x0020): >>> [cn] [sdap_parse_entry] (0x0020): >>> [gidNumber] [sdap_parse_entry] (0x0020): >>> [modifyTimestamp] [sdap_parse_entry] (0x0020): >>> [entryUSN] [sdap_get_groups_process] (0x0400): >>> Group contains: [sdap_get_groups_process] (0x0400): >>> 0: [originalDN] [sdap_get_groups_process] (0x0400): >>> 1: [name] [sdap_get_groups_process] (0x0400): >>> 2: [gidNumber] [sdap_get_groups_process] (0x0400): >>> 3: [originalModifyTimestamp] [sdap_get_groups_process] (0x0400): >>> 4: [entryUSN] [sdap_nested_group_process_send] (0x2000): >>> About to process group [cn=cmt_group_1,cn=groups,cn=accounts,dc=beta]
# LDAPSEARCH ON LDAP SERVER: [pcech@algol ~]$ ldapsearch -H ldap://localhost -D uid=admin,cn=users,cn=accounts,dc=beta -w myspulin -b cn=groups,cn=accounts,dc=beta "(&(cn=cmt_group_1)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))"
# extended LDIF # # LDAPv3 # base <cn=groups,cn=accounts,dc=beta> with scope subtree # filter: (&(cn=cmt_group_1)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0)))) # requesting: ALL #
# cmt_group_1, groups, accounts, beta dn: cn=cmt_group_1,cn=groups,cn=accounts,dc=beta objectClass: ipaobject objectClass: top objectClass: ipausergroup objectClass: posixgroup objectClass: groupofnames objectClass: nestedgroup cn: cmt_group_1 ipaUniqueID: db0b564e-7efe-11e6-a757-5254001a3efa gidNumber: 1703800166 member: uid=cmt_user_1,cn=users,cn=accounts,dc=beta
# search result search: 2 result: 0 Success
# numResponses: 2 # numEntries: 1
Question is why didn't SSSD obtain member attribute if I saw it in ldapsearch call? Is there something what I miss?
Lukas pointed out that it may not be the correct way to use IPA for handling users in groups in LDAP server. I understand I am working on AD case too.
But -- is it really possible to get different data via SSSD and ldapsearch() with the same filter and base?
Regards