id: cannot find name for group ID

[Mario Rossi]

Hi All!

I am running into an issue where groups cannot be resolved upon login. 
All servers on CentOS 6 work fine, so this is isolated to newer sssd 
version on CentOS 7.

[user@snoopy ~]$ id
uid=100001012(user) *gid=1001* *groups=1001*,10(wheel),1102

[user@snoopy ~]$ getent -s sss passwd user
user:*:100001012:1001:User Name:/home/user:/bin/bash

However, a quick lookup against the group:

[user@snoopy ~]$ *getent -s sss group security*
security:*:1001:user

Subsequent id lookup works:

[user@snoopy ~]$ id
uid=100001012(user) *gid=1001(security) 
**groups=1001(security)*,10(wheel),1102


Sudo also complains about the user, even after above command succeeds

[user@snoopy ~]$*sudo su -*
*sudo: unknown uid 100001012: who are you?*


A few seconds later sudo is no longer confused:

[user@snoopy ~]$*sudo su -*
*LDAP OnePassword for **user**:*
root@snoopy[~]#


SSSD config:

[sssd]
config_file_version = 2
sbus_timeout = 30
services = nss, pam, sudo, ssh
# BOUNCE DEV
domains = LOCAL, HOSTOPIA, DOMAIN1, DOMAIN2, DOMAIN3

[nss]
filter_users = 
adm,apache,avahi,bin,daemon,dbus,ecryptfs,ftp,git,games,gopher,haldaemon,halt,hfallback,hdeploy,influxdb,ldap,lp,mail,mailnull,named,news,nfsnobody,nobody,nscd,nslcd,ntp,operator,oprofile,osse
c,postfix,puppet,puppet-dashboard,pulse,pulse-access,radiusd,root,rpc,rpcuser,rtkit,saslauth,sfallback,shutdown,slocate,smmsp,sshd,sync,tcpdump,tss,uucp,vcsa
filter_groups = 
adm,apache,audio,bin,cdrom,cgred,daemon,dbus,dialout,dip,disk,ecryptfs,floppy,fuse,git,hfallback,hdeploy,influxdb,kmem,ldap,lock,lp,mail,mailnull,man,mem,nfsnobody,nobody,nscd,ntp,ossec,oprof
ile,postdrop,postfix,puppet,puppet-dashboard,pulse,pulse-access,root,rpc,rpcuser,rtkit,saslauth,sfallback,slocate,smmsp,sshd,sys,tape,tcpdump,tss,tty,users,utempter,utmp,vcsa,video


[pam]
debug_level = 0
reconnection_retries = 3
offline_credentials_expiration = 2
offline_failed_login_attempts = 3
offline_failed_login_delay = 5
pam_verbosity = 1
pam_pwd_expiration_warning = 21
pam_account_expired_message = Your LDAP password has expired, please use 
selfservice portal to change your LDAP password.

[sudo]
debug_level = 0

[ssh]
# debug_level = 0


[domain/LOCAL]
description = LOCAL Users domain
id_provider = local
enumerate = true
min_id = 500
max_id = 999
default_shell = /bin/bash
base_directory = /home
create_homedir = false
remove_homedir = true
homedir_umask = 077
skel_dir = /etc/skel
mail_dir = /var/spool/mail


All domains have the following options set:

######### SECTION: HOSTOPIA
[domain/HOSTOPIA]
min_id = 499
debug_level = 0
cache_credentials = True
entry_cache_timeout = 864000

auth_provider = ldap
id_provider = ldap
access_provider = ldap
chpass_provider = none
sudo_provider = ldap
selinux_provider = none
autofs_provider = none
hostid_provider = none

ldap_use_tokengroups = false

# 
https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-larg...
#ignore_group_members=True

lookup_family_order = ipv4_only

# LDAP Search
ldap_search_base = dc=hostopia,dc=com
ldap_group_search_base = 
ou=groups,o=Hostopia,dc=hostopia,dc=com?subtree?(|(cn=almighties)(cn=security)(cn=systems)(cn=bounce-development)(cn=development-wholesale)(cn=development-retail)(cn=abuse))
ldap_user_search_base = 
ou=users,o=hostopia,dc=hostopia,dc=com?subtree?(|(description=cn=bounce-development,ou=groups,o=Hostopia,dc=hostopia,dc=com)(description=cn=almighties,ou=groups,o=Hostopia,dc=hostopia
,dc=com)(description=cn=security,ou=groups,o=Hostopia,dc=hostopia,dc=com))

# LDAP Custom Schema
ldap_group_member = hMemberDN
ldap_user_member_of = description
# ldap_schema can be set to "rfc2307", which stores group member names 
in the
# "memberuid" attribute, or to "rfc2307bis", which stores group member

DNs in
# the "member" attribute. If you do not know this value, ask your LDAP
# administrator.
ldap_schema = rfc2307bis

ldap_network_timeout = 3
ldap_id_use_start_tls = False
ldap_tls_reqcert = never
ldap_tls_cacertdir = /etc/openldap/cacerts

# Ldap Servers
ldap_uri = ldaps://SERVER1, ldaps://SERVER2, ldaps://SERVER3
ldap_backup_uri = ldaps://1.1.1.1

ldap_default_authtok_type = obfuscated_password
ldap_default_bind_dn = ****
ldap_default_authtok = ******

ldap_user_ssh_public_key = sshPublicKey

ldap_pwd_policy = none
ldap_account_expire_policy = shadow
ldap_user_shadow_expire   = shadowExpire
# shadowExpire: days since Jan 1, 1970 that account is disabled: $ echo 
$(($(date --utc --date "$1" +%s)/86400))

ldap_chpass_update_last_change = false

ldap_access_order = filter, expire
ldap_access_filter = 
(&(objectClass=posixAccount)(uidNumber=*)(hAccountInitialSetup=1)(|(description=cn=bounce-development,ou=groups,o=Hostopia,dc=hostopia,dc=com)(description=cn=almighties,ou=groups,o=Hosto
pia,dc=hostopia,dc=com)(description=cn=security,ou=groups,o=Hostopia,dc=hostopia,dc=com)))

# SUDO
ldap_sudo_search_base = ou=sudoers,o=Hostopia,dc=hostopia,dc=com
ldap_sudo_full_refresh_interval = 86400
ldap_sudo_smart_refresh_interval = 3600
#entry_cache_sudo_timeout = 5400

#####  END DOMAIN SECTION  #####

[Mario Rossi]

Should I sanitize the logs and send them over ?
Thank you

On 07/23/2018 05:26 PM, Mario Rossi wrote:
>  Hi All!
>
>  I am running into an issue where groups cannot be resolved upon login. 
>  All servers on CentOS 6 work fine, so this is isolated to newer sssd 
>  version on CentOS 7.
>
>  [user@snoopy ~]$ id
>  uid=100001012(user) *gid=1001* *groups=1001*,10(wheel),1102
>
>  [user@snoopy ~]$ getent -s sss passwd user
>  user:*:100001012:1001:User Name:/home/user:/bin/bash
>
>  However, a quick lookup against the group:
>
>  [user@snoopy ~]$ *getent -s sss group security*
>  security:*:1001:user
>
>  Subsequent id lookup works:
>
>  [user@snoopy ~]$ id
>  uid=100001012(user) *gid=1001(security) 
>  **groups=1001(security)*,10(wheel),1102
>
>
>  Sudo also complains about the user, even after above command succeeds
>
>  [user@snoopy ~]$*sudo su -*
>  *sudo: unknown uid 100001012: who are you?*
>
>
>  A few seconds later sudo is no longer confused:
>
>  [user@snoopy ~]$*sudo su -*
>  *LDAP OnePassword for **user**:*
>  root@snoopy[~]#
>
>
>  SSSD config:
>
>  [sssd]
>  config_file_version = 2
>  sbus_timeout = 30
>  services = nss, pam, sudo, ssh
>  # BOUNCE DEV
>  domains = LOCAL, HOSTOPIA, DOMAIN1, DOMAIN2, DOMAIN3
>
>  [nss]
>  filter_users = 
>
> adm,apache,avahi,bin,daemon,dbus,ecryptfs,ftp,git,games,gopher,haldaemon,halt,hfallback,hdeploy,influxdb,ldap,lp,mail,mailnull,named,news,nfsnobody,nobody,nscd,nslcd,ntp,operator,oprofile,osse
>
> c,postfix,puppet,puppet-dashboard,pulse,pulse-access,radiusd,root,rpc,rpcuser,rtkit,saslauth,sfallback,shutdown,slocate,smmsp,sshd,sync,tcpdump,tss,uucp,vcsa
>  filter_groups = 
>
> adm,apache,audio,bin,cdrom,cgred,daemon,dbus,dialout,dip,disk,ecryptfs,floppy,fuse,git,hfallback,hdeploy,influxdb,kmem,ldap,lock,lp,mail,mailnull,man,mem,nfsnobody,nobody,nscd,ntp,ossec,oprof
>
> ile,postdrop,postfix,puppet,puppet-dashboard,pulse,pulse-access,root,rpc,rpcuser,rtkit,saslauth,sfallback,slocate,smmsp,sshd,sys,tape,tcpdump,tss,tty,users,utempter,utmp,vcsa,video
>
>
>  [pam]
>  debug_level = 0
>  reconnection_retries = 3
>  offline_credentials_expiration = 2
>  offline_failed_login_attempts = 3
>  offline_failed_login_delay = 5
>  pam_verbosity = 1
>  pam_pwd_expiration_warning = 21
>  pam_account_expired_message = Your LDAP password has expired, please 
>  use selfservice portal to change your LDAP password.
>
>  [sudo]
>  debug_level = 0
>
>  [ssh]
>  # debug_level = 0
>
>
>  [domain/LOCAL]
>  description = LOCAL Users domain
>  id_provider = local
>  enumerate = true
>  min_id = 500
>  max_id = 999
>  default_shell = /bin/bash
>  base_directory = /home
>  create_homedir = false
>  remove_homedir = true
>  homedir_umask = 077
>  skel_dir = /etc/skel
>  mail_dir = /var/spool/mail
>
>
>  All domains have the following options set:
>
>  ######### SECTION: HOSTOPIA
>  [domain/HOSTOPIA]
>  min_id = 499
>  debug_level = 0
>  cache_credentials = True
>  entry_cache_timeout = 864000
>
>  auth_provider = ldap
>  id_provider = ldap
>  access_provider = ldap
>  chpass_provider = none
>  sudo_provider = ldap
>  selinux_provider = none
>  autofs_provider = none
>  hostid_provider = none
>
>  ldap_use_tokengroups = false
>
>  # 
>
> https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-larg...
>  #ignore_group_members=True
>
>  lookup_family_order = ipv4_only
>
>  # LDAP Search
>  ldap_search_base = dc=hostopia,dc=com
>  ldap_group_search_base = 
>
> ou=groups,o=Hostopia,dc=hostopia,dc=com?subtree?(|(cn=almighties)(cn=security)(cn=systems)(cn=bounce-development)(cn=development-wholesale)(cn=development-retail)(cn=abuse))
>  ldap_user_search_base = 
>
> ou=users,o=hostopia,dc=hostopia,dc=com?subtree?(|(description=cn=bounce-development,ou=groups,o=Hostopia,dc=hostopia,dc=com)(description=cn=almighties,ou=groups,o=Hostopia,dc=hostopia
>  ,dc=com)(description=cn=security,ou=groups,o=Hostopia,dc=hostopia,dc=com))
>
>  # LDAP Custom Schema
>  ldap_group_member = hMemberDN
>  ldap_user_member_of = description
>  # ldap_schema can be set to "rfc2307", which stores group member names 
>  in the
>  # "memberuid" attribute, or to "rfc2307bis", which stores group
> member 
>  DNs in
>  # the "member" attribute. If you do not know this value, ask your LDAP
>  # administrator.
>  ldap_schema = rfc2307bis
>
>  ldap_network_timeout = 3
>  ldap_id_use_start_tls = False
>  ldap_tls_reqcert = never
>  ldap_tls_cacertdir = /etc/openldap/cacerts
>
>  # Ldap Servers
>  ldap_uri = ldaps://SERVER1, ldaps://SERVER2, ldaps://SERVER3
>  ldap_backup_uri = ldaps://1.1.1.1
>
>  ldap_default_authtok_type = obfuscated_password
>  ldap_default_bind_dn = ****
>  ldap_default_authtok = ******
>
>  ldap_user_ssh_public_key = sshPublicKey
>
>  ldap_pwd_policy = none
>  ldap_account_expire_policy = shadow
>  ldap_user_shadow_expire   = shadowExpire
>  # shadowExpire: days since Jan 1, 1970 that account is disabled: $ 
>  echo $(($(date --utc --date "$1" +%s)/86400))
>
>  ldap_chpass_update_last_change = false
>
>  ldap_access_order = filter, expire
>  ldap_access_filter = 
>
> (&(objectClass=posixAccount)(uidNumber=*)(hAccountInitialSetup=1)(|(description=cn=bounce-development,ou=groups,o=Hostopia,dc=hostopia,dc=com)(description=cn=almighties,ou=groups,o=Hosto
>
> pia,dc=hostopia,dc=com)(description=cn=security,ou=groups,o=Hostopia,dc=hostopia,dc=com)))
>
>  # SUDO
>  ldap_sudo_search_base = ou=sudoers,o=Hostopia,dc=hostopia,dc=com
>  ldap_sudo_full_refresh_interval = 86400
>  ldap_sudo_smart_refresh_interval = 3600
>  #entry_cache_sudo_timeout = 5400
>
>  #####  END DOMAIN SECTION  #####
>
>

[Mario Rossi]

Hi,

Any idea what to look for on this issue ?

Thanks

On 07/24/2018 04:33 PM, Mario Rossi wrote:
>  Should I sanitize the logs and send them over ?
>  Thank you
>
>  On 07/23/2018 05:26 PM, Mario Rossi wrote:
> > Hi All!
> >
> > I am running into an issue where groups cannot be resolved upon 
> > login. All servers on CentOS 6 work fine, so this is isolated to 
> > newer sssd version on CentOS 7.
> >
> > [user@snoopy ~]$ id
> > uid=100001012(user) *gid=1001* *groups=1001*,10(wheel),1102
> >
> > [user@snoopy ~]$ getent -s sss passwd user
> > user:*:100001012:1001:User Name:/home/user:/bin/bash
> >
> > However, a quick lookup against the group:
> >
> > [user@snoopy ~]$ *getent -s sss group security*
> > security:*:1001:user
> >
> > Subsequent id lookup works:
> >
> > [user@snoopy ~]$ id
> > uid=100001012(user) *gid=1001(security) 
> > **groups=1001(security)*,10(wheel),1102
> >
> >
> > Sudo also complains about the user, even after above command succeeds
> >
> > [user@snoopy ~]$*sudo su -*
> > *sudo: unknown uid 100001012: who are you?*
> >
> >
> > A few seconds later sudo is no longer confused:
> >
> > [user@snoopy ~]$*sudo su -*
> > *LDAP OnePassword for **user**:*
> > root@snoopy[~]#
> >
> >
> > SSSD config:
> >
> > [sssd]
> > config_file_version = 2
> > sbus_timeout = 30
> > services = nss, pam, sudo, ssh
> > # BOUNCE DEV
> > domains = LOCAL, HOSTOPIA, DOMAIN1, DOMAIN2, DOMAIN3
> >
> > [nss]
> > filter_users = 
> >
> adm,apache,avahi,bin,daemon,dbus,ecryptfs,ftp,git,games,gopher,haldaemon,halt,hfallback,hdeploy,influxdb,ldap,lp,mail,mailnull,named,news,nfsnobody,nobody,nscd,nslcd,ntp,operator,oprofile,osse
> >
> c,postfix,puppet,puppet-dashboard,pulse,pulse-access,radiusd,root,rpc,rpcuser,rtkit,saslauth,sfallback,shutdown,slocate,smmsp,sshd,sync,tcpdump,tss,uucp,vcsa
> > filter_groups = 
> >
> adm,apache,audio,bin,cdrom,cgred,daemon,dbus,dialout,dip,disk,ecryptfs,floppy,fuse,git,hfallback,hdeploy,influxdb,kmem,ldap,lock,lp,mail,mailnull,man,mem,nfsnobody,nobody,nscd,ntp,ossec,oprof
> >
> ile,postdrop,postfix,puppet,puppet-dashboard,pulse,pulse-access,root,rpc,rpcuser,rtkit,saslauth,sfallback,slocate,smmsp,sshd,sys,tape,tcpdump,tss,tty,users,utempter,utmp,vcsa,video
> >
> >
> > [pam]
> > debug_level = 0
> > reconnection_retries = 3
> > offline_credentials_expiration = 2
> > offline_failed_login_attempts = 3
> > offline_failed_login_delay = 5
> > pam_verbosity = 1
> > pam_pwd_expiration_warning = 21
> > pam_account_expired_message = Your LDAP password has expired, please 
> > use selfservice portal to change your LDAP password.
> >
> > [sudo]
> > debug_level = 0
> >
> > [ssh]
> > # debug_level = 0
> >
> >
> > [domain/LOCAL]
> > description = LOCAL Users domain
> > id_provider = local
> > enumerate = true
> > min_id = 500
> > max_id = 999
> > default_shell = /bin/bash
> > base_directory = /home
> > create_homedir = false
> > remove_homedir = true
> > homedir_umask = 077
> > skel_dir = /etc/skel
> > mail_dir = /var/spool/mail
> >
> >
> > All domains have the following options set:
> >
> > ######### SECTION: HOSTOPIA
> > [domain/HOSTOPIA]
> > min_id = 499
> > debug_level = 0
> > cache_credentials = True
> > entry_cache_timeout = 864000
> >
> > auth_provider = ldap
> > id_provider = ldap
> > access_provider = ldap
> > chpass_provider = none
> > sudo_provider = ldap
> > selinux_provider = none
> > autofs_provider = none
> > hostid_provider = none
> >
> > ldap_use_tokengroups = false
> >
> > # 
> >
> https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-larg...
> > #ignore_group_members=True
> >
> > lookup_family_order = ipv4_only
> >
> > # LDAP Search
> > ldap_search_base = dc=hostopia,dc=com
> > ldap_group_search_base = 
> >
> ou=groups,o=Hostopia,dc=hostopia,dc=com?subtree?(|(cn=almighties)(cn=security)(cn=systems)(cn=bounce-development)(cn=development-wholesale)(cn=development-retail)(cn=abuse))
> > ldap_user_search_base = 
> >
> ou=users,o=hostopia,dc=hostopia,dc=com?subtree?(|(description=cn=bounce-development,ou=groups,o=Hostopia,dc=hostopia,dc=com)(description=cn=almighties,ou=groups,o=Hostopia,dc=hostopia
> > ,dc=com)(description=cn=security,ou=groups,o=Hostopia,dc=hostopia,dc=com))
> >
> > # LDAP Custom Schema
> > ldap_group_member = hMemberDN
> > ldap_user_member_of = description
> > # ldap_schema can be set to "rfc2307", which stores group member 
> > names in the
> > # "memberuid" attribute, or to "rfc2307bis", which stores group 
> > member DNs in
> > # the "member" attribute. If you do not know this value, ask your LDAP
> > # administrator.
> > ldap_schema = rfc2307bis
> >
> > ldap_network_timeout = 3
> > ldap_id_use_start_tls = False
> > ldap_tls_reqcert = never
> > ldap_tls_cacertdir = /etc/openldap/cacerts
> >
> > # Ldap Servers
> > ldap_uri = ldaps://SERVER1, ldaps://SERVER2, ldaps://SERVER3
> > ldap_backup_uri = ldaps://1.1.1.1
> >
> > ldap_default_authtok_type = obfuscated_password
> > ldap_default_bind_dn = ****
> > ldap_default_authtok = ******
> >
> > ldap_user_ssh_public_key = sshPublicKey
> >
> > ldap_pwd_policy = none
> > ldap_account_expire_policy = shadow
> > ldap_user_shadow_expire   = shadowExpire
> > # shadowExpire: days since Jan 1, 1970 that account is disabled: $ 
> > echo $(($(date --utc --date "$1" +%s)/86400))
> >
> > ldap_chpass_update_last_change = false
> >
> > ldap_access_order = filter, expire
> > ldap_access_filter = 
> >
> (&(objectClass=posixAccount)(uidNumber=*)(hAccountInitialSetup=1)(|(description=cn=bounce-development,ou=groups,o=Hostopia,dc=hostopia,dc=com)(description=cn=almighties,ou=groups,o=Hosto
> >
> pia,dc=hostopia,dc=com)(description=cn=security,ou=groups,o=Hostopia,dc=hostopia,dc=com)))
> >
> > # SUDO
> > ldap_sudo_search_base = ou=sudoers,o=Hostopia,dc=hostopia,dc=com
> > ldap_sudo_full_refresh_interval = 86400
> > ldap_sudo_smart_refresh_interval = 3600
> > #entry_cache_sudo_timeout = 5400
> >
> > #####  END DOMAIN SECTION  #####
> >
> >
>

[Jakub Hrozek]

>  On 24 Jul 2018, at 22:33, Mario Rossi <mrossi(a)hostopia.com&gt;
> wrote:
>  
>  Should I sanitize the logs and send them over ?
>  Thank you 
yes

[Mario Rossi]

It turns out that by disabling min_uid/max_uid for each domain resolved 
the issue on CentOS 7 - sssd-1.16.0-19.el7_5.5.x86_64
Big thank you to Jakub for investigating this and also suggesting this 
workaround !

On 07/26/2018 11:47 AM, Jakub Hrozek wrote:
> > On 24 Jul 2018, at 22:33, Mario Rossi <mrossi(a)hostopia.com&gt; wrote:
> >
> > Should I sanitize the logs and send them over ?
> > Thank you
>  yes
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]...
>