December 2019 - sssd-users - Fedora mailing-lists

sssd performance on large domains
by zfnoctis＠gmail.com 03 Feb '22

03 Feb '22

Hi, I'm wondering if there are any plans to improve sssd performance on large active directory domains (100k+ users, 40k+ groups), or if there are settings I am not aware of that can greatly improve performance, specifically for workstation use cases. Currently if I do not set "ignore_group_members = True" in sssd.conf, logins can take upwards of 6 minutes and "sssd_be" will max the CPU for up to 20 minutes after logon, which makes it a non-starter. The reason I want to allow group members to be seen is that I want certain domain groups to be able to perform elevated actions using polkit. If I ignore group members, polkit reports that the group is empty and so no one can elevate in the graphical environment. Ultimately this means that Linux workstations are at a severe disadvantage since they cannot be bound to the domain and have the normal set of access features users and IT expect from macOS or Windows. Distributions used: Ubuntu 16.04 (sssd 1.13.4-1ubuntu1.1), Ubuntu 16.10 (sssd 1.13.4-3) and Fedora 24 (sssd-1.13.4-3.fc24). All exhibit the same problems. I've also tried "ldap_group_nesting_level = 1" without seeing any noticeable improvement with respect to performance. Putting the database on /tmp isn't viable as these are workstations that will reboot semi-frequently, and I don't believe this is an I/O bound performance issue anyways. Thanks for your time.

6 29

ID Views for IPA ID Views for AD users inconsistent resolution
by Louis Abel 01 Aug '21

01 Aug '21

I didn't get a response in #sssd, so I figured I'll try here at the mail list. # rpm -q sssd ipa-server sssd-1.16.0-19.el7_5.5.x86_64 ipa-server-4.5.4-10.el7_5.3.x86_64 I've been scratching my head trying to resolve this particular issue. I'm having issues with AD users where when they login, they'll get the UID/GID assigned in the ID views correctly, but only some of the time. Other times, they won't get the id view assigned to them. This is all done in the default trust view. What makes this issue even more interesting is that out of my 6 domain controllers, sometimes it'll be one server out of the six that does it, sometimes it's two. But it's never the same ones, so it's difficult to track the particular issue down. What's even more interesting is this is not occurring with some users (like my own). I have yet to see it occur with my account or even the rest of my team's accounts. One of the things I tried to do is delete the ID views of the offending users and recreate them to no avail. I put SSSD into debug mode on the IPA servers and tried to get some relevant logs and such to try and figure this out. Below is my SSSD configuration, ldb info, and debug logs (removing private information where possible). I'm trying to determine if this is either a bug within SSSD or if this is a misconfiguration on my part. $ ldbsearch -H cache_ipa.example.com.ldb name=user.name(a)ad.example.com originalADuidNumber uidNumber originalADgidNumber gidNumber asq: Unable to register control with rootdse! # record 1 dn: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb originalADuidNumber: 55616902 originalADgidNumber: 55616902 uidNumber: 55616902 gidNumber: 55616902 $ ipa idoverrideuser-show "Default Trust View" user.name(a)ad.example.com Anchor to override: user.name(a)ad.example.com UID: 40001 GID: 40001 Home directory: /home/user.name Login shell: /bin/bash $ ldbsearch -H timestamps_ipa.example.com.ldb | less dn: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb objectCategory: user originalModifyTimestamp: 20180823172515.0Z entryUSN: 92632390 initgrExpireTimestamp: 1535133621 lastUpdate: 1535128235 dataExpireTimestamp: 1535133635 distinguishedName: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb ## DEBUG LOGS (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_set_entry_attr] (0x0200): Entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] has set [ts_cache] attrs. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_print_server] (0x2000): Searching 172.20.23.190:389 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))][cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 32 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_add] (0x2000): New operation 32 timeout 6 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1080], connected[1], ops[(nil)], ldap[0x55f30a5d0f90] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a645310], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_entry] (0x1000): OriginalDN: [ipaanchoruuid=:SID:S-1-5-21-922099545-2851689246-2917073205-16902,cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [loginShell] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [uidNumber] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipaAnchorUUID] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [gidNumber] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [homeDirectory] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipaOriginalUid] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a645310], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_destructor] (0x2000): Operation 32 finished (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_done] (0x4000): Found override for object with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_destroy] (0x4000): releasing operation connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [uidNumber] with [40001] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x0080): Override attribute for [gidNumber] has more [2] than one value, using only the first. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [gidNumber] with [40001] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [homeDirectory] with [/home/user.name] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [loginShell] with [/bin/bash] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a6819a0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a681a60 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a6819a0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a681a60 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a6819a0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [safe_original_attributes] (0x4000): Original object does not have [sshPublicKey] set. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a683c50 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a683d10 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a683c50 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a683d10 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a683c50 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [uidNumber] of entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a68d1c0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a68d280 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a68d1c0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a68d280 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a68d1c0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_set_entry_attr] (0x0200): Entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] has set [cache, ts_cache] attrs. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a68d330 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a688900 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a68d330 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a689320 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a6893e0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a688900 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a68d330 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a689320 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a634920 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a6349e0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a6893e0 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a689320 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a634920 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a6349e0 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a634920 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Processing group 0/1 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Fetching group S-1-5-21-922099545-2851689246-2917073205-20676 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_print_server] (0x2000): Searching 172.20.23.190:389 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))][cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 33 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_add] (0x2000): New operation 33 timeout 6 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a63f270], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a63f270], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_destructor] (0x2000): Operation 33 finished (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_done] (0x4000): No override found with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_destroy] (0x4000): releasing operation connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Processing group 1/1 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_memberships_send] (0x0400): External group information still valid. ## /etc/sssd/sssd.conf [domain/ipa.example.com] cache_credentials = True krb5_store_password_if_offline = True # krb5_realm = IPA.EXAMPLE.COM ipa_domain = ipa.example.com ipa_hostname = entl01.ipa.example.com # Server Specific Settings ipa_server = entl01.ipa.example.com ipa_server_mode = True subdomain_homedir = %o fallback_homedir = /home/%u default_shell = /bin/bash id_provider = ipa auth_provider = ipa access_provider = ipa chpass_provider = ipa ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss, sudo, pam, ssh domains = ipa.example.com [nss] filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd,tomcat,activemq,informix,oracle,xdba,grid,dbadmin,weblogic,operator,postgres,devolog memcache_timeout = 600 homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp]

2 1

sssd-krb5, krb5_ccachedir, DIR-cache-store...
by Jostein Fossheim 15 Dec '20

15 Dec '20

We are working with several kerberos-REALMS and are trying to get our clients to store their kerberos tickets in a DIRECTORY. This seems to work nicely for clients not authenticating at login, with the following configuration set in /etc/krb5.conf. ... [libdefaults] ... default_ccache_name = DIR:/tmp/krb5cc_%{uid} ... user@server:~$ klist Ticket cache: DIR::/tmp/krb5cc_888/tkt Default principal: user@REALM Valid starting Expires Service principal 09/22/19 17:35:50 09/23/19 17:35:48 krbtgt/user@REALM Each ticket is stored in a separate file. For clients using sssd for login, I want to set up the same behavior. But when I attempt to login the system creates an "/tmp/krb5cc_${UiD}" - but here the directory don't get the excutable bit set (that is the directory get 0600-permission), and the login fails. In the man-page from Debian-buster (sssd-version: 1.16.3), there are to settings that seems to regulate this behaviour : krb5_ccachedir (string) Directory to store credential caches. All the substitution sequences of krb5_ccname_template can be used here, too, except %d and %P. The directory is created as private and owned by the user, with permissions set to 0700. Default: /tmp krb5_ccname_template (string) Location of the user's credential cache. Three credential cache types are currently supported: "FILE", "DIR" and "KEYRING:persistent". The cache can be specified either as TYPE:RESIDUAL, or as an absolute path, which implies the "FILE" type. In the template, the following sequences are substituted: [...] If the template ends with 'XXXXXX' mkstemp(3) is used to create a unique filename in a safe way. When using KEYRING types, the only supported mechanism is "KEYRING:persistent:%U", which uses the Linux kernel keyring to store credentials on a per-UID basis. This is also the recommended choice, as it is the most secure and predictable method. The default value for the credential cache name is sourced from the profile stored in the system wide krb5.conf configuration file in the [libdefaults] section. The option name is default_ccache_name. See krb5.conf(5)'s PARAMETER EXPANSION paragraph for additional information on the expansion format defined by krb5.conf. NOTE: Please be aware that libkrb5 ccache expansion template from krb5.conf(5) uses different expansion sequences than SSSD. Default: (from libkrb5) ... I have tried to both set and unset, the two parameters in question like this: krb5_ccachedir = /tmp/krb5cc_%U krb5_ccname_template = DIR: %d krb5_ccname_template = DIR:%d/krb5cc_%U_XXXXXX But the configuration-options seems to be ignored, no matter what I do, and I have the same behavior: A non-executable directory is created and the user is unable to login. If I set the +x bit on the directory manually as the root-user, everything works.

4 5

sssd with samba
by Edouard Guigné 20 Nov '20

20 Nov '20

Dear sssd users, I would like to get informations about the use of sssd with samba (centos 7, samba 4.8.3). I need it because I configured a samba share, accessible with sssd. The authentication is against a windows AD. My /etc/nsswitch.cnf is configured only with sssd : /passwd: files sss// //shadow: files sss// //group: files sss/ For an other purpose, I set an sftpd access also configured with sssd against the AD. I followed some discussions on the samba user list about samba + sssd. I would like to understand if there are some issues with sssd and samba 4.8.3 on centos 7 ? Or is it with next RHEL 8 ? /The RHEL 8 documentation states this: // //// //"Red Hat only supports running Samba as a server with the winbindd // //service to provide domain users and groups to the local system. Due to // //certain limitations, such as missing Windows access control list (ACL) // //support and NT LAN Manager (NTLM) fallback, SSSD is not supported." // //// //https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/deploying_different_types_of_servers/assembly_using-samba-as-a-server_deploying-different-types-of-servers//// //// //What's confusing is that the RHEL 7 documentation says: // //// //"Prior to Red Hat Enterprise Linux 7.1, only Winbind provided this // //functionality. In Red Hat Enterprise Linux 7.1 and later, you no longer // //need to run Winbind and SSSD in parallel to access SMB shares. For // //example, accessing the Access Control Lists (ACLs) no longer requires // //Winbind on SSSD clients." // //// //and // //// //"4.2.2. Determining Whether to Use SSSD or Winbind for SMB Shares // //For most SSSD clients, using SSSD is recommended:" // //// //and most worrisome, in my use case: // //// //"In environments with direct Active Directory integration where the // //clients use SSSD for general Active Directory user mappings, using // //Winbind for the SMB ID mapping instead of SSSD can result in // //inconsistent mapping." / In my case, running samba 4.8.3 with SSSD on centos 7 do I need to : - enable and start winbind service , in conjunction to sssd ? - or only sssd is enough with samba ? - Do I have to fear issues in next release of sssd for the support of samba ? especially for acls support ?/ / A nsswitch.conf like : passwd: files sss winbind shadow: files sss winbind group: files sss winbind or passwd: files winbind sss shadow: files winbind sss group: files winbind sss Does not seem to work... I test and this is not stable. Best Regards, Edouard

5 6

Is there an RFC or detailed design document describing SSSD's ID Mapping algorithm?
by Jeff Thornsen 23 Jan '20

23 Jan '20

The reason I ask is because I use a bunch of storage appliances that offer Secure-NFS (NETAPP, EMC UNITY, etc.), but they only support NIS, IDMU, RFC2307, and RFC2307bis style Identity Mapping, all of which require manual assignment of UID/GID numbers to objects in LDAP, which is untenable for large environments. Microsoft even removed Unix Attribute editor from their LDAP GUI for the RFC2307 attributes in Windows Server 2016 to push people away from using rfc2307. I would like to be able to provide a link to an RFC or design document describing the SSSD ID Mapping algorithm so that these 3rd party vendors can incorporate an identical identity mapping algorithm into their products, so that I can use their Secure-NFS product in conjunction with sssd and have the uid and gid numbers match up with the other Linux hosts in our environment.

5 6

Unreadable GPOs should not be logged as a critical failure
by Gordon Messmer 27 Dec '19

27 Dec '19

We've recently started receiving a lot of complaints from users about broadcast messages of the form: Message from syslogd@hostname at Dec 4 09:08:35 ... sssd[be[domain.lan]]:Group Policy Container with DN [cn={66062A26-FA18-4C56-A7E1-B22209856319},cn=policies,cn=system,DC=domain,DC=lan] is unreadable or has unreadable or missing attributes. In order to fix this make sure that this AD object has following attributes readable: nTSecurityDescriptor, cn, gPCFileSysPath, gPCMachineExtensionNames, gPCFunctionalityVersion, flags. Alternatively if you do not have access to the server or can not change permissions on this object, you can use option ad_gpo_ignore_unreadable = True which will skip this GPO.See 'man ad_gpo_ignore_unreadable for details.' We've reviewed the AD object with that DN and determined that they are scoped to specific sets of workstations using AD groups, such as "Domain Laptops". As far as we can tell, this is entirely normal, and there's no reason to log an error, much less broadcast a message to every open terminal every time GPOs are processed. I'm aware of the ad_gpo_ignore_unreadable setting, but the default seems to be the wrong behavior, and I'd like to suggest changing that.

1 0

Re: How do new LDAP security recommendations from MS affect sssd clients?
by Chris P. 17 Dec '19

17 Dec '19

Just wondering if there is any more news regarding the patch for sssd to work with the new MS requirements? Curerrently I'm being notified that ALL linux servers are reporting this in the AD logs: "...client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a clear text (non-SSL/TLS-encrypted) LDAP connection..." We are planning to test a sssd client with a patched AD server to see if this will break AD auth on our sssd clients, but wanted to see if a patch for sssd has been made available anywhere to use ldaps or ldap with sssd. Thanks, Chris

3 6

Pros/cons of access_provider=ad + access.conf file vs access_provider=simple?
by Spike White 16 Dec '19

16 Dec '19

Sssd experts, We have an AD-based sssd configuration that is working. For RHEL6, 7 and 8. We've done thorough lab testing + pilot projects. All good (with certain RHEL6 restrictions). Currently, we're using access_provider = simple, with the appropriate simple_allow_groups and simple_allow_users lines in /etc/sssd/sssd.conf. Works fine. A reviewer mentioned we should be using access_provider = ad + /etc/security/access.conf file to restrict access. (We have pam_access.so in our pam stack already, to disallow direct root login and other limited uses.) Obviously that second approach would work too. The claim is the first approach would allow in AD accounts with expired passwords and locked accounts. Whereas the second approach would not. I'm attempting to test this claim -- I have an account I can lock easily. But does anyone have any best practices for access_provider? The advantage of this first approach is that it's already coded and thoroughly tested. The pilot projects use this. The one advantage of the second approach that I'm certain of is that RHEL6 does not have a realm permit command. So to permit a user or group in RHEL6 using the first approach is different between RHEL6 and 7/8. (To me, that's not huge.) Spike

3 3

Re: How do new LDAP security recommendations from MS affect sssd clients?
by Gary Molenkamp 10 Dec '19

10 Dec '19

> I'm currently working on patches to allow LDAPS as well and make sure > that SASL/GSSAPI/GSS-SPNEGO are set up so that it can be used together > with TLS. HTH Good morning, Is there an expected eta for the patches to be available? Pending that, Is it possible to have two "ldap" providers in the same domain with different ldap settings? For example, if using ad for auth_provider and ldap for id/access providers [domain/example.com] auth_provider = ldap auth_provider ldap server x.example.com id_provider = ldap id_provider ldap server y.example.com Such that the ad auth provider can now use ldap TLS/SSL to the password server, but identity can still be managed by another server? This may seen to be a weird setup, but it allows separation of roles/responsibilities. Thanks Gary -- Gary Molenkamp Computer Science/Science Technology Services Systems Administrator University of Western Ontario molenkam(a)uwo.ca http://www.csd.uwo.ca (519) 661-2111 x86882 (519) 661-3566

1 0

Can SSSD sort the autofs map
by Oguzhan Eris 09 Dec '19

09 Dec '19

Hi everyone. First off, thanks to everyone who's ever worked on SSSD. It's easily in my top 5 favorite FOSS projects out there. I am not sure if this is the right way to ask for an enhancement, or whether I should file an issue on GitHub, but I am running into an issue that's described in this Red Hat page https://access.redhat.com/solutions/3673501 (login required) Basically for an automount map where I need nested top level paths: /mnt/foo /mnt/foo/bar each defined by their own map objects. SSSD does not handle this (neither does LDAP directly from autofs) because the return map from LDAP is unsorted, and if the maps are provided to autofs ordered as: /mnt/foo/bar /mnt/foo the /mnt/foo map masks the previous /mnt/foo/bar map and you'll only get the entries from /mnt/foo Using file based mount maps, one can easily sort the top level maps, and get around this issue. Would it be possible to have SSSD return the maps from LDAP query in a sorted way? There is an LDAP control that most LDAP servers support to return a sorted output, ( https://ldapwiki.com/wiki/Server%20Side%20Sort%20Control ) but with so many clients and a large list, this might be better left to the client to do instead. I'm happy to help out if someone can point me in the right direction in the code. Thanks again

5 11

Re: [Freeipa-users] Re: FreeIPA and IPV6
by TomK 06 Dec '19

06 Dec '19

On 12/4/2019 11:16 AM, Alexander Bokovoy via FreeIPA-users wrote: > On ke, 04 joulu 2019, Stephen John Smoogen via FreeIPA-users wrote: >> On Tue, 3 Dec 2019 at 21:43, TomK via FreeIPA-users >> <freeipa-users(a)lists.fedorahosted.org> wrote: >>> >>> Hey All, >>> >>> Does FreeIPA fully support IPV6 or are there corner cases and >>> limitations that could make it a show stopper? >>> >> >> Can you define 'fully support' IPV6? I say this from seeing various IT >> groups still having to deal with major network hardware vendors saying >> they 'fully support IPV6' but still needing weekly firmware updates >> because of switch crashes due to IPv6 options. And the problem seems >> to be that the IPV6 spec is complex and spread out over multiple >> documents with parts implemented from draft documents that never got >> out of committee. At times I doubt anything fully supports IPv6 so it >> is better to come up with what you mean by what you need IPv6 support >> to do and work from there. > > Yep. On the other hand, FreeIPA does have few open IPv6-related problems > at the moment. It is known to work in the most IPv6 environments we have > seen so far but there are management issues in DNS handling, for > example. > > https://pagure.io/freeipa/issue/5658 > https://pagure.io/freeipa/issue/4674 > > Whether these issues prevent you to deploy FreeIPA in IPv6-only > environment is up to you. > Thanks everyone. What I mean by 'fully supported' is just as the subject says, the FreeIPA piece. To clarify a bit further I'll break this down into two parts: 1) FreeIPA Core Project: Let's assume for the sake of this discussion that the OS, Hardware and what not fully supports IPv6. So in other words, anything outside the realm of what you control or code within the FreeIPA project is out of scope of this question. 2) Integration: FreeIPA / SSSD will integrate with a host of technologies including SSSD, 389 Directory Server etc. If any of those components aren't ready and impact FreeIPA components, I would be interested to know. -- Thx, TK.

1 1

How to have a dynamic ldap_default_bind_dn value in sssd.conf?
by Oscar Torrente 06 Dec '19

06 Dec '19

Hello. I'm using a LDAP server for authentication/identification of users. I've set its ACIs so that every user just can access to its own data But now I have a problem in sssd clients: I should put the correct ldap_default_bind_dn value to make the request, a value which should be dynamic as it's typed on gdm/login/ssh/whatever. How can I do that? I don't want to write the admin's cn (and password!) in client's sssd.conf files! Thanks!! P.S: I've asked the same topic in https://serverfault.com/questions/993030/how-to-have-a-dynamic-ldap-default… but sadly there's no answer....

3 4

Use the users Kerberos credentials with 'ldap_sasl_mech = gssapi'
by Jasper Siepkes 06 Dec '19

06 Dec '19

Hi all! As far as I can tell the option 'ldap_sasl_mech = gssapi' in sssd.conf always makes LDAP use a Kerberos keytab for LDAP searches. As far as I can tell there is no way to use the users Kerberos credentials? I think this design comes from how Windows does it with AD? I would like to use the Kerberos credentials of the user who has just logged-in instead. Maybe I'm somewhat paranoid or missing something but I'm not really comfortable with hundreds of hosts / machines with keytabs on them which give access to LDAP. Extracting that keytab from a machine is not that hard I think. I think in most use-cases the user only needs to be able to see LDAP entries (ie. other users with privacy sensitive information like names and other GDPR problematic data) which LDAP ACI's allow them. Is there currently a way to configure SSSD in such a way? Kind regards, Jasper

4 7

install sssd version 2
by Jannis Mann 06 Dec '19

06 Dec '19

Hi, I want to install sssd version 2. Are there any limitations? I've installed sssd on suse, ubuntu and centos with the latest repos and only get sssd version 1.16 How can I upgrade to version 2? Thank you! Jannis

2 1

Fedora 30 and 31 instant fail at gdm login greeter PIN prompt
by Zynda, Bradley V. (GSFC-423.0)[ADNET SYSTEMS INC] 05 Dec '19

05 Dec '19

Hello, pam.d/system-auth auth [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_sss.so try_cert_auth pam.d/smartcard-auth auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet auth sufficient pam_sss.so ignore_authinfo_unavail require_cert_auth auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so etc/sssd/sssd.conf [sssd] services = nss, pam domains = files [nss] [pam] pam_cert_auth = True pam_cert_db_path = /etc/sssd/pki/<cert>.pem debug_level = 4 [domain/files] id_provider = files [certmap/files/<user>] matchrule = <EKU>msScLogin<SUBJECT>^.*,UID=<user>,.*$ gdm.d/greeter-login enable-smartcard-authentication=true enable-fingerprint-authentication=false enable-password-authentication=false Reboot and get Card PIN user prompt gdm-login-greeter -> add username and click next Get Prompted for PIN but after a second it just fails and goes back to asking for username. Has anyone run into this behaviour, suggestions, fix? Seems to be a reoccurring issue I have seen in +F28, +CentOS7 and +RHEL7 basically anything with obsolete coolkey pkcs11 authconfig. Thanks, Brad

2 12

p11_child does not locate custom SmartCard library driver
by Jeff Thornsen 04 Dec '19

04 Dec '19

Hi, I am trying to configure Smart Card authentication on CentOS7 using sssd version 2.2.2 (re-compiled from source, as the official repo for CentOS7 only has sssd 1.16.x, but we need the certmap features of sssd 2.x). We use special smart card hardware (Gemalto PrimeID) which requires a custom library (provided to us from the vendor as RPM and DEB packages). The actual library gets installed to /usr/lib64/libeTPkcs11.so If I create a *.module file under either /usr/share/p11-kit/modules or /etc/pkcs11/modules pointing to /usr/lib64/libeTPkcs11.so, then the command 'p11tool --list-tokens' properly reads the smartCard and lists the tokens on it. However, running 'p11_child --pre' (per various other threads from Sumit Bose) does not even list our custom library (the libeTPkcs11.so) in the Default Module List, so it fails to read the SmartCard. The only modules listed are '[NSS Internal PKCS #11 Module]' and '[CoolKey PKCS #11 Module]' Is there some command I need to run in order to register our custom SmartCard library with NSS or P11-kit such that sssd's p11_child knows how to use it? How does p11_child locate the available smartCard libraries?

2 2

sssd-ipa client not showing windows groups
by Franky Van Liedekerke 02 Dec '19

02 Dec '19

Hi, I have 2 rhel8 servers here: one acting as IPA server with a trust to an AD domain that has posix attributes, the other one acting as ipa client to the first one. The packages installed on the client: sssd-tools-2.0.0-43.el8_0.3.x86_64 sssd-common-2.0.0-43.el8_0.3.x86_64 libsss_sudo-2.0.0-43.el8_0.3.x86_64 sssd-ad-2.0.0-43.el8_0.3.x86_64 libsss_idmap-2.0.0-43.el8_0.3.x86_64 sssd-client-2.0.0-43.el8_0.3.x86_64 sssd-common-pac-2.0.0-43.el8_0.3.x86_64 sssd-ldap-2.0.0-43.el8_0.3.x86_64 sssd-2.0.0-43.el8_0.3.x86_64 python3-sss-murmur-2.0.0-43.el8_0.3.x86_64 python3-sss-2.0.0-43.el8_0.3.x86_64 sssd-nfs-idmap-2.0.0-43.el8_0.3.x86_64 libsss_nss_idmap-2.0.0-43.el8_0.3.x86_64 sssd-krb5-common-2.0.0-43.el8_0.3.x86_64 sssd-krb5-2.0.0-43.el8_0.3.x86_64 sssd-ipa-2.0.0-43.el8_0.3.x86_64 libsss_certmap-2.0.0-43.el8_0.3.x86_64 python3-sssdconfig-2.0.0-43.el8_0.3.noarch libsss_autofs-2.0.0-43.el8_0.3.x86_64 sssd-proxy-2.0.0-43.el8_0.3.x86_64 sssd-kcm-2.0.0-43.el8_0.3.x86_64 The master config: [domain/my.unix.domain] id_provider = ipa ipa_server_mode = True ipa_server = ipaserver.my.unix.domain ipa_domain = my.unix.domain ipa_hostname = ipaserver.my.unix.domain.sys auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True #override_homedir = /home/%u subdomain_homedir = /home/%u debug_level = 10 [sssd] services = nss, pam, ifp, ssh, sudo domains = my.unix.domain debug_level = 10 The slave config: [domain/my.unix.domain] debug_level=10 id_provider = ipa ipa_server = _srv_, ipaserver.my.unix.domain ipa_domain = my.unix.domain ipa_hostname = ipaserver.my.unix.domain auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True #subdomain_enumerate = all [sssd] services = nss, pam, ssh, sudo domains = my.unix.domain debug_level=10 Now on the master I can resolve all AD groups/users that have posix attributes. But on the slave I have issues: - it can't resolve users where the primary groupid doesn't exist (no issue on the master, apparently some known limitiation ?). The reason this is an issue seems to be that each user has his "own" private group as primary group configured in AD (the primary gid is the same as the uid). Anyway, I can work around this issue by defining the needed groups in Identity Management I guess. - I can't seem to get any group resolving to work. I don't expect to see the group members (no enumeration), but on a slave "getent group blabla(a)AD.DOMAIN" doesn't work at all, no AD groups are returned. When I do the getent group command on the IPA client, I get this in the logs on the IPA server: (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=blabla(a)ad.domain] (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaUserOverride)(uid=blabla))]. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaUserOverride)(uid=blabla))][cn=Default Trust View,cn=views,cn=accounts,dc=my,dc=unix,dc=domain]. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [ipa_get_ad_override_done] (0x4000): No override found with filter [(&(objectClass=ipaUserOverride)(uid=blabla))]. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=blabla)(objectclass=user)(sAMAccountName=*)(&(uidNumber=*)(!(uidNumber=0))))][dc=ad,dc=domain]. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sysdb_cache_search_groups] (0x2000): Search groups with filter: (&(objectCategory=group)(ghost=blabla(a)ad.domain)) (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=blabla(a)AD.DOMAIN] (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(|(krbPrincipalName=blabla@AD.DOMAIN)(mail=blabla@AD.DOMAIN)(krbPrincipalName=blabla\\@AD.DOMAIN@MY.UNIX.DOMAIN))(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))][cn=accounts,dc=my,dc=unix,dc=domain]. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(&(|(krbPrincipalName=blabla@AD.DOMAIN)(mail=blabla@AD.DOMAIN)(krbPrincipalName=blabla\\@AD.DOMAIN@MY.UNIX.DOMAIN))(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))(objectClass=ipaIDObject))][cn=trusts,dc=my,dc=unix,dc=domain]. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sysdb_cache_search_groups] (0x2000): Search groups with filter: (&(objectCategory=group)(ghost=blabla(a)AD.DOMAIN)) (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sysdb_search_user_by_upn] (0x0400): No entry with upn [blabla(a)AD.DOMAIN] found. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=blabla(a)AD.DOMAIN] (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaUserOverride)(uid=blabla))]. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaUserOverride)(uid=blabla))][cn=Default Trust View,cn=views,cn=accounts,dc=my,dc=unix,dc=domain]. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [ipa_get_ad_override_done] (0x4000): No override found with filter [(&(objectClass=ipaUserOverride)(uid=blabla))]. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(|(userPrincipalName=blabla@AD.DOMAIN)(mail=blabla@AD.DOMAIN)(userPrincipalName=blabla\\@AD.DOMAIN@AD.DOMAIN))(objectclass=user)(sAMAccountName=*)(&(uidNumber=*)(!(uidNumber=0))))][dc=ad,dc=domain]. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sysdb_cache_search_groups] (0x2000): Search groups with filter: (&(objectCategory=group)(ghost=blabla(a)AD.DOMAIN)) (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sysdb_search_user_by_upn] (0x0400): No entry with upn [blabla(a)AD.DOMAIN] found. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [dp_get_account_info_send] (0x0200): Got request for [0x2][BE_REQ_GROUP][name=blabla(a)ad.domain] (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaGroupOverride)(cn=blabla))]. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaGroupOverride)(cn=blabla))][cn=Default Trust View,cn=views,cn=accounts,dc=my,dc=unix,dc=domain]. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [ipa_get_ad_override_done] (0x4000): No override found with filter [(&(objectClass=ipaGroupOverride)(cn=blabla))]. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=blabla)(objectClass=group)(sAMAccountName=*)(&(gidNumber=*)(!(gidNumber=0))))][dc=ad,dc=domain]. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_get_groups_process] (0x0400): Search for groups, returned 1 results. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_has_deref_support_ex] (0x0400): The server supports deref method ASQ (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_check_ad_group_type] (0x4000): AD group [] has type flags 0x80000002. (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_nested_group_hash_insert] (0x4000): Inserting [CN=blabla,OU=xxx,OU=xxx,DC=AD,DC=DOMAIN] into hash table [groups] (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_nested_group_process_send] (0x2000): About to process group [CN=blabla,OU=xxx,OU=xxx,DC=AD,DC=DOMAIN] So it does search for the group (in the end), and finds it too; after which it starts looking for each member in the group. In the end it says this: (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_process_ghost_members] (0x0400): The group has 23 members (Mon Dec 2 13:31:29 2019) [sssd[be[my.unix.domain]]] [sdap_process_ghost_members] (0x0400): Group has 23 members But apparently some issues exist with those members, since all are stored as "ghost members" and later on it returns no external members for the group. But the client returns the group to be unknown, not a group with 0 members. If I set "ignore_group_members = true" on the IPA master, the client shows the group as expected. So maybe it is also related to the first issue of an unknown primary group for users (in this case members of the group)? Maybe someone can shed any light on this? With friendly regards, Franky

1 0

test
by Christopher Helm 01 Dec '19

01 Dec '19

test

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users December 2019