sssd net rpc rights SeDiskOperatorPrivilege

[Henry McLaughlin]

I have sssd configured and working with my domain member server and I now wish to grant
the SeDiskOperatorPrivilege to the "MYDOMAIN\Domain Admins" group. When I
execute the command it appears to disregard the domain name and grant the privileges to
the group "Unix Group\domain admins"

net rpc rights list accounts -U'MYDOMAIN\administrator'
Enter MYDOMAIN\administrator's password:

...
Unix Group\domain admins
No privileges assigned

net rpc rights grant 'MYDOMAIN\Domain Admins' SeDiskOperatorPrivilege
-U'MYDOMAIN\administrator'
Enter MYDOMAIN\administrator's password:
Successfully granted rights.

net rpc rights list accounts -U'MYDOMAIN\administrator'
Enter MYDOMAIN\administrator's password:

...
Unix Group\domain admins
SeDiskOperatorPrivilege

net rpc rights revoke 'MYDOMAIN\Domain Admins' SeDiskOperatorPrivilege
-U'MYDOMAIN\administrator'
Enter MYDOMAIN\administrator's password:
Successfully revoked rights.

net rpc rights list accounts -U'MYDOMAIN\administrator'
Enter MYDOMAIN\administrator's password:

...
Unix Group\domain admins
No privileges assigned

Below I have completely removed the domain name from the command and still get the same
outcome.

net rpc rights grant 'Domain Admins' SeDiskOperatorPrivilege
-U'MYDOMAIN\administrator'
Enter MYDOMAIN\administrator's password:
Successfully granted rights.

net rpc rights list accounts -U'MYDOMAIN\administrator'
Enter MYDOMAIN\administrator's password:

...
Unix Group\domain admins
SeDiskOperatorPrivilege

[Sumit Bose]

On Tue, Jan 19, 2016 at 08:43:40PM -0000, Henry McLaughlin wrote:
>  I have sssd configured and working with my domain member server and I
> now wish to grant the SeDiskOperatorPrivilege to the "MYDOMAIN\Domain Admins"
> group. When I execute the command it appears to disregard the domain name and grant the
> privileges to the group "Unix Group\domain admins" 
I'll try to reproduce this and see why it happens. I'll come back to you
when I have some results.

bye,
Sumit

> 
> net rpc rights list accounts -U'MYDOMAIN\administrator'
> Enter MYDOMAIN\administrator's password:
> 
> ...
> Unix Group\domain admins
> No privileges assigned
> 
> net rpc rights grant 'MYDOMAIN\Domain Admins' SeDiskOperatorPrivilege
-U'MYDOMAIN\administrator'
> Enter MYDOMAIN\administrator's password:
> Successfully granted rights.
> 
> net rpc rights list accounts -U'MYDOMAIN\administrator'
> Enter MYDOMAIN\administrator's password:
> 
> ...
> Unix Group\domain admins
> SeDiskOperatorPrivilege
> 
> net rpc rights revoke 'MYDOMAIN\Domain Admins' SeDiskOperatorPrivilege
-U'MYDOMAIN\administrator'
> Enter MYDOMAIN\administrator's password:
> Successfully revoked rights.
> 
> net rpc rights list accounts -U'MYDOMAIN\administrator'
> Enter MYDOMAIN\administrator's password:
> 
> ...
> Unix Group\domain admins
> No privileges assigned
> 
> Below I have completely removed the domain name from the command and still get the
same outcome.
> 
> net rpc rights grant 'Domain Admins' SeDiskOperatorPrivilege
-U'MYDOMAIN\administrator'
> Enter MYDOMAIN\administrator's password:
> Successfully granted rights.
> 
> net rpc rights list accounts -U'MYDOMAIN\administrator'
> Enter MYDOMAIN\administrator's password:
> 
> ...
> Unix Group\domain admins
> SeDiskOperatorPrivilege
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
> https://lists.fedorahosted.org/admin/lists/[e-mail]

[Henry McLaughlin]

I have just read that my version of sssd 1.11.5 has problems with mapping:

https://lists.samba.org/archive/samba/2015-January/188338.html

[Jakub Hrozek]

On Tue, Jan 19, 2016 at 11:07:57PM -0000, Henry McLaughlin wrote:
>  I have just read that my version of sssd 1.11.5 has problems with
> mapping:
>  
>  https://lists.samba.org/archive/samba/2015-January/188338.html 
Yes, that version is quite old, can you try something newer?

[Henry McLaughlin]

My distro Ubuntu 14.04 LTS only comes with 1.11.5

The next LTS is due April

[Longina Przybyszewska]

The next LTS - Xenial  has already sssd-13.3

Longina

>  -----Oprindelig meddelelse-----
>  Fra: Henry McLaughlin [mailto:[e-mail]]
>  Sendt: 20. januar 2016 10:51
>  Til: sssd-users(a)lists.fedorahosted.org
>  Emne: [SSSD-users] Re: sssd net rpc rights SeDiskOperatorPrivilege
>  
>  My distro Ubuntu 14.04 LTS only comes with 1.11.5
>  
>  The next LTS is due April
>  _______________________________________________
>  sssd-users mailing list
>  sssd-users(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/admin/lists/[e-mail]
>

[Lukas Slebodnik]

On (20/01/16 09:50), Henry McLaughlin wrote:
> My distro Ubuntu 14.04 LTS only comes with 1.11.5
>
> The next LTS is due April 
Or you can use repo from launchpad on trusty
https://launchpad.net/~sssd/+archive/ubuntu/updates

LS