Re: [SSSD-users] SSSD-1.12.5 and group membership problem

[Jakub Hrozek]

On Thu, Aug 13, 2015 at 04:32:12PM +0000, Longina Przybyszewska wrote:
>  Hi,
>  I have  an issue with SSSD-1.12.5 with resolving group membership.
>  Only Posix  primary group is displayed for users accounts.
>  
>  Group is visible on the system but not displayed from 'id' or 'groups'
> commands.
>  
>  getent group 30000005
>  data-adm-lnx-nfs0a-rw-id-00001:*:30000005:
>  
>  getent group data-adm-lnx-nfs0a-rw-id-00001
>  data-adm-lnx-nfs0a-rw-id-00001:*:30000005:
>  
>  id user1
>  uid=xxxxxxx(user1) gid=30000000(lnx-primary) groups=30000000(lnx-primary)
>  
>  Group object has  Posix gid and is setup as universal group in realm A.C.DOM.ORG:
>  ...
>  gidNumber = 30000005
>  memberUid: user1, user2
>  ....
>  I have AD as id_,access_auth_provider.
>  Users have got Posix attributes in AD.
>  Computer and group objects are from the same realm: A.C.DOM.ORG.
>  User objects are in all realms: N.C.DOM.ORG, A.C.DOM.ORG, C.DOM.ORG
>  
>  
>  With my setup I can achieve:
>  - login with short names across realm
>  - access kerberized nfs homedir
>  
>  Is there a way to resolve correctly group's membership with this setup?? 
It's not really possible to answer without logs, but if you're looking
for cross-domain memberships, then you need to use only one [domain]
section in sssd.conf and let the id_provider=ad (or rather
subdomain_provider=ad, but its value is inherited from id_provider, no
need to set it explicitly) discover the subdomains.

What might also be problematic is using POSIX IDs -- because only the
Global Catalog can be used to resolve cross-domain memberships at the
moment and POSIX attributes are not normally present in GC, then maybe
the safest way would be to modify the AD schema to replicate the
attributes to GC.

>  
>  My sssd.conf :
>  
>  [nss]
>  debug_level = 9
>  filter_groups = root
>  filter_users =
> root,lightdm,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd
>  
>  
>  [sssd]
>  debug_level = 6
>  domains = n.c.dom.org,a.c.dom.org,c.dom.org
>  
>  config_file_version = 2
>  services = nss,pam,ssh
>  
>  [pam]
>  pam_verbosity = 3
>  debug_level = 9
>  
>  [domain/n.c.dom.org]
>  debug_level = 9
>  dyndns_update = false
>  id_provider = ad
>  access_provider = ad
>  auth_provider = ad
>  chpass_provider = ad
>  ad_domain = n.c.dom.org
>  krb5_realm = N.C.DOM.ORG
>  #cache_credentials = True
>  default_shell = /bin/bash
>  
>  use_fully_qualified_names = False
>  ldap_id_mapping = False
>  subdomains_provider = none
>  ad_gpo_access_control = disabled
>  
>  [domain/a.c.dom.org]
>  debug_level = 9
>  dyndns_update = false
>  id_provider = ad
>  access_provider = ad
>  auth_provider = ad
>  chpass_provider = ad
>  ad_domain = a.c.dom.org
>  krb5_realm = A.C.DOM.ORG
>  default_shell = /bin/bash
>  use_fully_qualified_names = False
>  ldap_id_mapping = False
>  subdomains_provider = none
>  ad_gpo_access_control = disabled
>  
>  [domain/c.dom.org]
>  debug_level = 9
>  dyndns_update = true
>  dyndns_update_ptr = false
>  ad_hostname = adm-lnx101.a.c.dom.org
>  id_provider = ad
>  access_provider = ad
>  auth_provider = ad
>  chpass_provider = ad
>  ad_domain = c.dom.org
>  krb5_realm = C.DOM.ORG
>  default_shell = /bin/bash
>  use_fully_qualified_names = False
>  ldap_id_mapping = False
>  subdomains_provider = none
>  ad_gpo_access_control = disabled
>  
>  Best,
>  longina
>  
>  
>  
>  
>  
>  
>  [nss]
>  debug_level = 9
>  filter_groups = root
>  filter_users =
> root,lightdm,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd
>  #override_home_directory = /home/%u
>  
>  [sssd]
>  debug_level = 6
>  domains = nat.c.sdu.dk,adm.c.sdu.dk,c.sdu.dk
>  #default_domain_suffix = c.sdu.dk
>  config_file_version = 2
>  services = nss,pam
>  
>  [pam]
>  pam_verbosity = 3
>  debug_level = 9
>  
>  [domain/LOCAL]
>  description = local machine accounts
>  id_provider = local
>  enumerate = true
>  min_id = 101
>  max_id = 1100
>  
>  [domain/nat.c.sdu.dk]
>  debug_level = 9
>  dyndns_update = false
>  id_provider = ad
>  access_provider = ad
>  auth_provider = ad
>  chpass_provider = ad
>  ad_domain = nat.c.sdu.dk
>  krb5_realm = NAT.C.SDU.DK
>  #cache_credentials = True
>  #krb5_store_password_if_offline = True
>  default_shell = /bin/bash
>  
>  use_fully_qualified_names = False
>  ldap_id_mapping = False
>  subdomains_provider = none
>  [domain/adm.c.sdu.dk]
>  debug_level = 9
>  dyndns_update = false
>  id_provider = ad
>  access_provider = ad
>  auth_provider = ad
>  chpass_provider = ad
>  ad_domain = adm.c.sdu.dk
>  krb5_realm = ADM.C.SDU.DK
>  #cache_credentials = True
>  #krb5_store_password_if_offline = True
>  default_shell = /bin/bash
>  use_fully_qualified_names = False
>  ldap_id_mapping = False
>  subdomains_provider = none
>  
>  [domain/c.sdu.dk]
>  debug_level = 9
>  dyndns_update_ptr = false
>  id_provider = ad
>  access_provider = ad
>  auth_provider = ad
>  chpass_provider = ad
>  ad_domain = c.sdu.dk
>  krb5_realm = C.SDU.DK
>  #cache_credentials = True
>  #krb5_store_password_if_offline = True
>  default_shell = /bin/bash
>  use_fully_qualified_names = False
>  ldap_id_mapping = False
>  subdomains_provider = none
>  dyndns_update = true
>  ad_hostname = test-lnx03.a.c.dom.org
>  
>  The topology of
>  
>  Mange hilsner
>  Longina
>   
>  _______________________________________________
>  sssd-users mailing list
>  sssd-users(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-users