2:53 p.m.
We want to move our net groups from NIS to IPA. I’ve loaded the groups. They’re visible on
a system that uses nslcd pointed at the IPA server. But the systems that use SSSD for
authentication don’t show anything. The net groups all show as undefined.
I’ve turned on debugging and looked at the LDAP logs. It does the right quotes and the log
says it extracts the members. But they don’t show up.
Any idea where to look?
3:41 p.m.
OK, I see what’s going on, but it looks like a bug.
We mostly use net groups for hosts. In NIS our entries like like (hostname,,) You can put
that into IPA by specifying NISdomain=, i.e. blank domain name. However if you do that,
getent shows no entries. That is, entries with blank hostname are ignored. I claim this is
a bug, since for a host entry there’s no reason to specify a domain.
I also found that specifying
ipa_netgroup_domain=cs.rutgers.edu<http://cs.rutgers.edu>
causes no net groups to display, even ones whose domain is
cs.rutgers.edu<http://cs.rutgers.edu>. This also looks like a bug.
On Nov 8, 2017, at 3:53 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
We want to move our net groups from NIS to IPA. I’ve loaded the groups. They’re visible on
a system that uses nslcd pointed at the IPA server. But the systems that use SSSD for
authentication don’t show anything. The net groups all show as undefined.
I’ve turned on debugging and looked at the LDAP logs. It does the right quotes and the log
says it extracts the members. But they don’t show up.
Any idea where to look?
3:46 p.m.
Netapp wants the domain field to be blank. That leaves us a problem that’s hard to
solve.
On Nov 8, 2017, at 4:41 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
OK, I see what’s going on, but it looks like a bug.
We mostly use net groups for hosts. In NIS our entries like like (hostname,,) You can put
that into IPA by specifying NISdomain=, i.e. blank domain name. However if you do that,
getent shows no entries. That is, entries with blank hostname are ignored. I claim this is
a bug, since for a host entry there’s no reason to specify a domain.
I also found that specifying
ipa_netgroup_domain=cs.rutgers.edu<http://cs.rutgers.edu/>
causes no net groups to display, even ones whose domain is
cs.rutgers.edu<http://cs.rutgers.edu/>;. This also looks like a bug.
On Nov 8, 2017, at 3:53 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
We want to move our net groups from NIS to IPA. I’ve loaded the groups. They’re visible on
a system that uses nslcd pointed at the IPA server. But the systems that use SSSD for
authentication don’t show anything. The net groups all show as undefined.
I’ve turned on debugging and looked at the LDAP logs. It does the right quotes and the log
says it extracts the members. But they don’t show up.
Any idea where to look?
4:08 p.m.
Pavel, does this sound like the bug you were looking at wrt sudo lately?
On Wed, Nov 08, 2017 at 09:46:25PM +0000, Charles Hedrick wrote:
Netapp wants the domain field to be blank. That leaves us a problem
that’s hard to solve.
On Nov 8, 2017, at 4:41 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
OK, I see what’s going on, but it looks like a bug.
We mostly use net groups for hosts. In NIS our entries like like (hostname,,) You can
put that into IPA by specifying NISdomain=, i.e. blank domain name. However if you do
that, getent shows no entries. That is, entries with blank hostname are ignored. I claim
this is a bug, since for a host entry there’s no reason to specify a domain.
I also found that specifying
ipa_netgroup_domain=cs.rutgers.edu<http://cs.rutgers.edu/>
causes no net groups to display, even ones whose domain is
cs.rutgers.edu<http://cs.rutgers.edu/>;. This also looks like a bug.
On Nov 8, 2017, at 3:53 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
We want to move our net groups from NIS to IPA. I’ve loaded the groups. They’re visible
on a system that uses nslcd pointed at the IPA server. But the systems that use SSSD for
authentication don’t show anything. The net groups all show as undefined.
I’ve turned on debugging and looked at the LDAP logs. It does the right quotes and the
log says it extracts the members. But they don’t show up.
Any idea where to look?
_______________________________________________
sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
4:47 p.m.
In my opinion the whole rfc3704bis implementation of net groups is wonky.
This isn’t the only problem. Why is there a distinction between internal and external
hosts? Suppose I add an external host to a net group, and later do ipa host-add for it. If
the distinction actually matters I’d expect the system to turn the external host entry
into an internal host entry. But it doesn’t.
In principle there’s a difference between blank and -, but the ipa implementation always
produces - for missing user and host and blank for missing domain name.
I’d really rather see the system just store the triples rather than doing a complex
mapping going in and out.
On Nov 8, 2017, at 5:08 PM, Jakub Hrozek <jhrozek(a)redhat.com>
wrote:
Pavel, does this sound like the bug you were looking at wrt sudo lately?
On Wed, Nov 08, 2017 at 09:46:25PM +0000, Charles Hedrick wrote:
> Netapp wants the domain field to be blank. That leaves us a problem that’s hard to
solve.
>
> On Nov 8, 2017, at 4:41 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
>
> OK, I see what’s going on, but it looks like a bug.
>
> We mostly use net groups for hosts. In NIS our entries like like (hostname,,) You
can put that into IPA by specifying NISdomain=, i.e. blank domain name. However if you do
that, getent shows no entries. That is, entries with blank hostname are ignored. I claim
this is a bug, since for a host entry there’s no reason to specify a domain.
>
> I also found that specifying
>
>
ipa_netgroup_domain=cs.rutgers.edu<https://na01.safelinks.protection.o...
>
> causes no net groups to display, even ones whose domain is
cs.rutgers.edu<https://na01.safelinks.protection.outlook.com/?url=http...;.
This also looks like a bug.
>
> On Nov 8, 2017, at 3:53 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
>
> We want to move our net groups from NIS to IPA. I’ve loaded the groups. They’re
visible on a system that uses nslcd pointed at the IPA server. But the systems that use
SSSD for authentication don’t show anything. The net groups all show as undefined.
>
> I’ve turned on debugging and looked at the LDAP logs. It does the right quotes and
the log says it extracts the members. But they don’t show up.
>
> Any idea where to look?
>
>
>
> _______________________________________________
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
_______________________________________________
sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
6:17 p.m.
Charles Hedrick wrote:
In my opinion the whole rfc3704bis implementation of net groups is
wonky.
Since you seem to be using FreeIPA wouldn't it be a better solution to
implement a script for converting your netgroups into HBAC rules?
I never did this myself though.
Ciao, Michael.
2:43 p.m.
On (08/11/17 20:53), Charles Hedrick wrote:
We want to move our net groups from NIS to IPA. I’ve loaded the
groups. They’re visible on a system that uses nslcd pointed at the IPA server. But the
systems that use SSSD for authentication don’t show anything. The net groups all show as
undefined.
I’ve turned on debugging and looked at the LDAP logs. It does the right quotes and the log
says it extracts the members. But they don’t show up.
Any idea where to look?
How did you add netgroups to IPA?
Did you migrate from LDAP to IPA ("ipa migrate-ds")
Did you add them from command line with "ipa"?
if yes then could you provide exact commands ?
LS
1:04 p.m.
On Nov 9, 2017, at 3:43 PM, Lukas Slebodnik
<lslebodn(a)redhat.com> wrote:
On (08/11/17 20:53), Charles Hedrick wrote:
> We want to move our net groups from NIS to IPA. I’ve loaded the groups. They’re
visible on a system that uses nslcd pointed at the IPA server. But the systems that use
SSSD for authentication don’t show anything. The net groups all show as undefined.
>
> I’ve turned on debugging and looked at the LDAP logs. It does the right quotes and
the log says it extracts the members. But they don’t show up.
>
> Any idea where to look?
>
How did you add netgroups to IPA?
Did you migrate from LDAP to IPA ("ipa migrate-ds”)
We went from a flat file to IPA. I wrote a script that did ipa netgroup-add and
ipa-netgroup-add-member.
Here’s a piece of it
ipa netgroup-add-member dcsug_servers_remus1 --hosts=cumulus.rutgers.edu
ipa netgroup-add-member dcsug_servers_remus1 --hosts=stratus.rutgers.edu
ipa netgroup-add dcsinternet_clients
ipa netgroup-add-member dcsinternet_clients --netgroups=dcsinternet_sunclients
ipa netgroup-add dcsfac_linuxclients
ipa netgroup-add-member dcsfac_linuxclients --hosts=abhib.rutgers.edu
ipa netgroup-add-member dcsfac_linuxclients --hosts=atanasoff.rutgers.edu
ipa netgroup-add-member dcsfac_linuxclients --hosts=borges.rutgers.edu
Pretty obvious.
However I discovered that all the net groups were created with a bogus nisdomain. Because
netapp documentation says to leave it blank, I cleared all the nis domains with
ipa netgroup-mod NAME —nisdomain=
That turned out to be the issue. sssd won’t show a triple unless it has a non-blank domain
entry in the domain field. This looks like a bug.
For the moment the plan is to use nslcd, i.e. ldap, for netgroups on the servers that need
net groups (just NFS servers in our case).
I don’t believe we can tell sssd to use IPA for users and groups but ldap for netgroups. I
want the features of IPA for users.
Did you add them from command line with "ipa"?
if yes then could you provide exact commands ?
LS
_______________________________________________
sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
3:25 a.m.
On 11/08/2017 11:47 PM, Charles Hedrick wrote:
In my opinion the whole rfc3704bis implementation of net groups is
wonky.
This isn’t the only problem. Why is there a distinction between internal and external
hosts? Suppose I add an external host to a net group, and later do ipa host-add for it. If
the distinction actually matters I’d expect the system to turn the external host entry
into an internal host entry. But it doesn’t.
In principle there’s a difference between blank and -, but the ipa implementation always
produces - for missing user and host and blank for missing domain name.
I’d really rather see the system just store the triples rather than doing a complex
mapping going in and out.
> On Nov 8, 2017, at 5:08 PM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
>
> Pavel, does this sound like the bug you were looking at wrt sudo lately?
>
> On Wed, Nov 08, 2017 at 09:46:25PM +0000, Charles Hedrick wrote:
>> Netapp wants the domain field to be blank. That leaves us a problem that’s hard
to solve.
>>
>> On Nov 8, 2017, at 4:41 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
>>
>> OK, I see what’s going on, but it looks like a bug.
>>
>> We mostly use net groups for hosts. In NIS our entries like like (hostname,,)
You can put that into IPA by specifying NISdomain=, i.e. blank domain name. However if you
do that, getent shows no entries. That is, entries with blank hostname are ignored. I
claim this is a bug, since for a host entry there’s no reason to specify a domain.
>>
>> I also found that specifying
>>
>>
ipa_netgroup_domain=cs.rutgers.edu<https://na01.safelinks.protection.o...
>>
>> causes no net groups to display, even ones whose domain is
cs.rutgers.edu<https://na01.safelinks.protection.outlook.com/?url=http...;.
This also looks like a bug.
>>
>> On Nov 8, 2017, at 3:53 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
>>
>> We want to move our net groups from NIS to IPA. I’ve loaded the groups. They’re
visible on a system that uses nslcd pointed at the IPA server. But the systems that use
SSSD for authentication don’t show anything. The net groups all show as undefined.
>>
>> I’ve turned on debugging and looked at the LDAP logs. It does the right quotes
and the log says it extracts the members. But they don’t show up.
>>
>> Any idea where to look?
Can you send us some example of what you are trying to achieve and what
does not work? I'm also ccing Alexander Bokovoy to see why IPA adds
somewhere dash and somewhere blanks.
4:29 a.m.
On ma, 13 marras 2017, Pavel Březina wrote:
On 11/08/2017 11:47 PM, Charles Hedrick wrote:
>In my opinion the whole rfc3704bis implementation of net groups is
>wonky.
RFC 3704bis does not exist. RFC3704 is about ingress filtering in
multihome networks. Are you talking about RFC 2307bis?
>This isn’t the only problem. Why is there a distinction between
>internal and external hosts? Suppose I add an external host to a net
>group, and later do ipa host-add for it. If the distinction actually
>matters I’d expect the system to turn the external host entry into an
>internal host entry. But it doesn’t.
>
>In principle there’s a difference between blank and -, but the ipa
>implementation always produces - for missing user and host and blank
>for missing domain name.
For hosts and users, if you specify hostCategory=all
or
userCategory=all, there will be blanks in the generated
nisNetgroupTriple.
For NIS domain name there is always either explicitly defined
nisDomainName or a '-'. Where did you see blanks for the nisDomainName?
Actual mapping rule looks like this:
schema-compat-entry-attribute: nisNetgroupTriple=(%link("%ifeq(\"hostCategory\
",\"all\",\"\",\"%collect(\\\"%{externalHost}\\\",\\\"%deref(\\\\\\\"memberHo
st\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\
\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberHost\\\\\\\",\\\\\\\"member\
\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\")\")","%ifeq(\"hostCategory\",\"all\",\"\",\
"-\")",",","%ifeq(\"userCategory\",\"all\",\"\",\"%collect(\\\"%deref(\\\\\\\
"memberUser\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\
\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberUser\\\\\\\",\\\\\\\"
member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\")\")","%ifeq(\"userCategory\",\"all\",
\"\",\"-\")"),%{nisDomainName:-})
As you can see in the last part it includes %{nisDomainName:-}, e.g. if
attribute nisDomainName is not defined in the original IPA net group
object, it will be replaced by '-'.
So one way to solve this problem is by replacing the
"%{nisDomainName:-}" by a more complex expression, something that would
use some predefined nisDomainName to be a trigger to add a blank there.
Something like
%ifeq("nisDomainName","any","","%{nisDomainName:-}"
instead of %{nisDomainName:-}
In my case it looks like this:
# ipa netgroup-show my-new-netgroup
Netgroup name: my-new-netgroup
NIS domain name: any
User category: all
Host category: all
# ldapsearch -x -b cn=ng,cn=compat,$SUFFIX cn=my-new-netgroup
dn: cn=my-new-netgroup,cn=ng,cn=compat,$SUFFIX
objectClass: nisNetgroup
objectClass: top
nisNetgroupTriple: (,,)
cn: my-new-netgroup
>I’d really rather see the system just store the triples rather
than
>doing a complex mapping going in and out.
IPA uses a different LDAP schema for
net groups than what RFC2307bis expects.
Thus, a need to dynamically redefine LDAP objects (for whole RFC2307,
not just net groups).
>
>
>>On Nov 8, 2017, at 5:08 PM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
>>
>>Pavel, does this sound like the bug you were looking at wrt sudo lately?
>>
>>On Wed, Nov 08, 2017 at 09:46:25PM +0000, Charles Hedrick wrote:
>>>Netapp wants the domain field to be blank. That leaves us a problem that’s
hard to solve.
>>>
>>>On Nov 8, 2017, at 4:41 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
>>>
>>>OK, I see what’s going on, but it looks like a bug.
>>>
>>>We mostly use net groups for hosts. In NIS our entries like like
>>>(hostname,,) You can put that into IPA by specifying NISdomain=,
>>>i.e. blank domain name. However if you do that, getent shows no
>>>entries. That is, entries with blank hostname are ignored. I claim
>>>this is a bug, since for a host entry there’s no reason to specify a
>>>domain.
>>>
>>>I also found that specifying
>>>
>>>ipa_netgroup_domain=cs.rutgers.edu<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fcs.rutgers.edu%2F&data=02%7C01%7Chedrick%40rutgers.edu%7Cfdea024ced1e456bf72208d526f561b0%7Cb92d2b234d35447093ff69aca6632ffe%7C1%7C0%7C636457757716393543&sdata=AA3P65kxArCD2WkRwAkGV5ci5jaCN54AZKPZ%2B8O4tbc%3D&reserved=0>
>>>
>>>causes no net groups to display, even ones whose domain is
>>>cs.rutgers.edu<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fcs.rutgers.edu%2F&data=02%7C01%7Chedrick%40rutgers.edu%7Cfdea024ced1e456bf72208d526f561b0%7Cb92d2b234d35447093ff69aca6632ffe%7C1%7C0%7C636457757716393543&sdata=AA3P65kxArCD2WkRwAkGV5ci5jaCN54AZKPZ%2B8O4tbc%3D&reserved=0>.
>>>This also looks like a bug.
>>>
>>>On Nov 8, 2017, at 3:53 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
>>>
>>>We want to move our net groups from NIS to IPA. I’ve loaded the
>>>groups. They’re visible on a system that uses nslcd pointed at the
>>>IPA server. But the systems that use SSSD for authentication don’t
>>>show anything. The net groups all show as undefined.
>>>
>>>I’ve turned on debugging and looked at the LDAP logs. It does the
>>>right quotes and the log says it extracts the members. But they
>>>don’t show up.
>>>
>>>Any idea where to look?
Can you send us some example of what you are trying to achieve and
what does not work? I'm also ccing Alexander Bokovoy to see why IPA
adds somewhere dash and somewhere blanks.
--
/ Alexander Bokovoy
10 a.m.
Sure. We use netgroups for /etc/exports. The most natural format for triples is
(host,,)
That’s the format Netapp documents. By default, ipa netgroup-add-member uses
(host,-,domain)
where domain seems to come from our Kerberos domain. Netapp documentation requests leaving
that field blank, though some documentation suggests that if it’s filled in, they will
ignore triples where the domain doesn’t match the Netapp’s domain. We are no longer using
NIS, so as far as we know, the Netapp doesn’t have a NIS domain. I think it’s safest to
leave the field blank.
I can do this in IPA. —nisdomain= will leave it blank. That results in
(host,-,)
That works with the Netapp. (I haven’t actually tried putting a domain in.)
Unfortunately it won’t work with sssd, because sssd won’t show any triples if the
nisdomain isn’t set for that net group.
In general I don’t understand why IPA and sssd are using a nonstandard representation of
net groups. Why not just a collection of triples and subgroups? As far as I can see RFC
2307bis has the same schema for net groups as RFC 2307.
https://tools.ietf.org/html/draft-howard-rfc2307bis-02. Is there a later version of RFC
2307bis that I haven’t been able to find? Draft 2 is the latest at
tools.ietf.org<http://tools.ietf.org>.
( 1.3.6.1.1.1.2.8 NAME 'nisNetgroup' SUP top STRUCTURAL
DESC 'Abstraction of a netgroup. May refer to other
netgroups'
MUST cn
MAY ( nisNetgroupTriple $ memberNisNetgroup $ description ) )
The representation used by IPA seems to be non-standard. I’d expect IPA and sssd to allow
me to add any triple I want that’s valid in a normal net group file.
One problem with the IPA representation is that there are no actual triples. There’s a
list of hosts, a list of users, and a domain. Not all triples can be represented that way.
Something like
(host1, user1,)
(host2, user2,)
has to be represented by a user list of user1, user2 and a host list of host1, host2. But
the pairing isn’t always well defined. E.g. I added to that group an external host3 and an
internal user3. I ended up with
(host3, user1,)
(host1, user2,)
(host2, user3,)
I don’t know whether there are applications that use the pairing of hosts and users, but
the original design was intended to support that. With IPA it’s dangerous, because I have
to know just how IPA generates the triples from the entires.
Is there a way to get the RFC-defined behavior from IPA and SSSD?
We don’t actually have a user case for pairing. We just need a host list. So for the
moment the plan is to add hosts with nisdomain=, and use nslcd in nsswitch.conf for net
groups on the Linux systems that are NFS servers.
I don’t have any specific use case for distinguishing between space and -. But the spec
says they mean something different. I don’t know why you would adopt a representation that
doesn’t allow for every valid triple.
On Nov 13, 2017, at 4:25 AM, Pavel Březina
<pbrezina@redhat.com<mailto:pbrezina@redhat.com>> wrote:
Can you send us some example of what you are trying to achieve and what does not work?
I'm also ccing Alexander Bokovoy to see why IPA adds somewhere dash and somewhere
blanks.
10:11 a.m.
While we’re on this subject, it would be useful for IPA to support netgroup.byhost. That
would give signifiant advantages with Netapp. If that is supported, Netapp will look up
the netgroups for a host every time a mount is done. Without it, they consider that
reloading the whole net group file is too inefficient, so they depend upon a cache whose
normal TTL is a day.
On Nov 13, 2017, at 4:25 AM, Pavel Březina
<pbrezina(a)redhat.com> wrote:
On 11/08/2017 11:47 PM, Charles Hedrick wrote:
> In my opinion the whole rfc3704bis implementation of net groups is wonky.
>
> This isn’t the only problem. Why is there a distinction between internal and external
hosts? Suppose I add an external host to a net group, and later do ipa host-add for it. If
the distinction actually matters I’d expect the system to turn the external host entry
into an internal host entry. But it doesn’t.
>
> In principle there’s a difference between blank and -, but the ipa implementation
always produces - for missing user and host and blank for missing domain name.
>
> I’d really rather see the system just store the triples rather than doing a complex
mapping going in and out.
>
>
>> On Nov 8, 2017, at 5:08 PM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
>>
>> Pavel, does this sound like the bug you were looking at wrt sudo lately?
>>
>> On Wed, Nov 08, 2017 at 09:46:25PM +0000, Charles Hedrick wrote:
>>> Netapp wants the domain field to be blank. That leaves us a problem that’s
hard to solve.
>>>
>>> On Nov 8, 2017, at 4:41 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
>>>
>>> OK, I see what’s going on, but it looks like a bug.
>>>
>>> We mostly use net groups for hosts. In NIS our entries like like (hostname,,)
You can put that into IPA by specifying NISdomain=, i.e. blank domain name. However if
you do that, getent shows no entries. That is, entries with blank hostname are ignored. I
claim this is a bug, since for a host entry there’s no reason to specify a domain.
>>>
>>> I also found that specifying
>>>
>>>
ipa_netgroup_domain=cs.rutgers.edu<https://na01.safelinks.protection.o...
>>>
>>> causes no net groups to display, even ones whose domain is
cs.rutgers.edu<https://na01.safelinks.protection.outlook.com/?url=http...;.
This also looks like a bug.
>>>
>>> On Nov 8, 2017, at 3:53 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
>>>
>>> We want to move our net groups from NIS to IPA. I’ve loaded the groups.
They’re visible on a system that uses nslcd pointed at the IPA server. But the systems
that use SSSD for authentication don’t show anything. The net groups all show as
undefined.
>>>
>>> I’ve turned on debugging and looked at the LDAP logs. It does the right
quotes and the log says it extracts the members. But they don’t show up.
>>>
>>> Any idea where to look?
Can you send us some example of what you are trying to achieve and what does not work?
I'm also ccing Alexander Bokovoy to see why IPA adds somewhere dash and somewhere
blanks.
10:30 a.m.
I just looked at documentation and source code. All the documentation I can find for
netgroups leaves the semantics up to the application. The net group documentation does,
however, imply that we’re dealing with a set of triples, not separate host and user lists.
I checked the source for both openssh and bsd rlogin. For them it appears that they ignore
the pairing and treat the net group as a list of hosts and users.
I don’t see how you could prove that there are no applications that use all the documented
capabilities of netgroups, but the most likely two possibilities don’t.
rlogin ignores triples that aren’t in the current NIS domain (or blank, presumably). sshd
ignores the domain component.
On Nov 13, 2017, at 4:25 AM, Pavel Březina
<pbrezina(a)redhat.com> wrote:
On 11/08/2017 11:47 PM, Charles Hedrick wrote:
> In my opinion the whole rfc3704bis implementation of net groups is wonky.
>
> This isn’t the only problem. Why is there a distinction between internal and external
hosts? Suppose I add an external host to a net group, and later do ipa host-add for it. If
the distinction actually matters I’d expect the system to turn the external host entry
into an internal host entry. But it doesn’t.
>
> In principle there’s a difference between blank and -, but the ipa implementation
always produces - for missing user and host and blank for missing domain name.
>
> I’d really rather see the system just store the triples rather than doing a complex
mapping going in and out.
>
>
>> On Nov 8, 2017, at 5:08 PM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
>>
>> Pavel, does this sound like the bug you were looking at wrt sudo lately?
>>
>> On Wed, Nov 08, 2017 at 09:46:25PM +0000, Charles Hedrick wrote:
>>> Netapp wants the domain field to be blank. That leaves us a problem that’s
hard to solve.
>>>
>>> On Nov 8, 2017, at 4:41 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
>>>
>>> OK, I see what’s going on, but it looks like a bug.
>>>
>>> We mostly use net groups for hosts. In NIS our entries like like (hostname,,)
You can put that into IPA by specifying NISdomain=, i.e. blank domain name. However if
you do that, getent shows no entries. That is, entries with blank hostname are ignored. I
claim this is a bug, since for a host entry there’s no reason to specify a domain.
>>>
>>> I also found that specifying
>>>
>>>
ipa_netgroup_domain=cs.rutgers.edu<https://na01.safelinks.protection.o...
>>>
>>> causes no net groups to display, even ones whose domain is
cs.rutgers.edu<https://na01.safelinks.protection.outlook.com/?url=http...;.
This also looks like a bug.
>>>
>>> On Nov 8, 2017, at 3:53 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
>>>
>>> We want to move our net groups from NIS to IPA. I’ve loaded the groups.
They’re visible on a system that uses nslcd pointed at the IPA server. But the systems
that use SSSD for authentication don’t show anything. The net groups all show as
undefined.
>>>
>>> I’ve turned on debugging and looked at the LDAP logs. It does the right
quotes and the log says it extracts the members. But they don’t show up.
>>>
>>> Any idea where to look?
Can you send us some example of what you are trying to achieve and what does not work?
I'm also ccing Alexander Bokovoy to see why IPA adds somewhere dash and somewhere
blanks.
10:44 a.m.
On ma, 13 marras 2017, Charles Hedrick wrote:
Sure. We use netgroups for /etc/exports. The most natural format for
triples is
(host,,)
That’s the format Netapp documents. By default, ipa netgroup-add-member uses
(host,-,domain)
where domain seems to come from our Kerberos domain. Netapp
documentation requests leaving that field blank, though some
documentation suggests that if it’s filled in, they will ignore triples
where the domain doesn’t match the Netapp’s domain. We are no longer
using NIS, so as far as we know, the Netapp doesn’t have a NIS domain.
I think it’s safest to leave the field blank.
IPA sets NIS domain by default to its
primary domain (equal to IPA
realm in lower case). This is just a default value.
I can do this in IPA. —nisdomain= will leave it blank. That results
in
(host,-,)
That works with the Netapp. (I haven’t actually tried putting a domain in.)
Unfortunately it won’t work with sssd, because sssd won’t show any
triples if the nisdomain isn’t set for that net group.
So, the real issue is
SSSD's inability to support empty netgroup domain
part, right?
This is the code in ipa_netgr_process_all():
...
ret = sysdb_attrs_get_string(state->netgroups[i], SYSDB_NETGROUP_DOMAIN,
&domain);
if (ret != EOK) {
goto done;
}
...
DEBUG(SSSDBG_TRACE_INTERNAL, "Putting together triples of "
"netgroup %d\n", i);
for (j = 0; j < uids_count; j++) {
for (k = 0; k < hosts_count; k++) {
triple = talloc_asprintf(state, "(%s,%s,%s)",
hosts[k], uids[j],
domain);
if (triple == NULL) {
ret = ENOMEM;
goto done;
}
ret = sysdb_attrs_add_string(state->netgroups[i],
SYSDB_NETGROUP_TRIPLE,
triple);
if (ret != EOK) {
goto done;
}
}
}
So, if no domain is retrieved, no netgroup triple is generated by SSSD
IPA provider. Note that this does not utilize compatibility netgroups
subtree as generated by schema compatibility plugin (in
cn=ng,cn=compat,$SUFFIX) but instead works directly with IPA netgroups.
So our discussion about RFC2307bis is not really applicable here. If we
consider the use case with a blank nisDomainName a valid one (and I
think we can consider it), the code above needs to be fixed to allow
such use. It is a fairly simple fix.
In general I don’t understand why IPA and sssd are using a
nonstandard
representation of net groups. Why not just a collection of triples and
subgroups? As far as I can see RFC 2307bis has the same schema for net
groups as RFC 2307.
https://tools.ietf.org/html/draft-howard-rfc2307bis-02. Is there a
later version of RFC 2307bis that I haven’t been able to find? Draft 2
is the latest at tools.ietf.org<http://tools.ietf.org>.
( 1.3.6.1.1.1.2.8 NAME 'nisNetgroup' SUP top STRUCTURAL
DESC 'Abstraction of a netgroup. May refer to other
netgroups'
MUST cn
MAY ( nisNetgroupTriple $ memberNisNetgroup $ description ) )
The representation used by IPA seems to be non-standard. I’d expect IPA
and sssd to allow me to add any triple I want that’s valid in a normal
net group file.
You can read (old) explanation on why IPA has schema as it has:
https://www.freeipa.org/page/FreeIPAv2:DS_Design_Summary#Netgroups
One problem with the IPA representation is that there are no actual
triples. There’s a list of hosts, a list of users, and a domain. Not
all triples can be represented that way. Something like (host1, user1,)
(host2, user2,)
has to be represented by a user list of user1, user2 and a host list of
host1, host2. But the pairing isn’t always well defined. E.g. I added
to that group an external host3 and an internal user3. I ended up with
(host3, user1,)
(host1, user2,)
(host2, user3,)
I don’t know whether there are applications that use the pairing of
hosts and users, but the original design was intended to support that.
With IPA it’s dangerous, because I have to know just how IPA generates
the triples from the entires.
Frankly speaking, original RFC2307bis design had very
little explanation
on the actual semantics. It just listed attributes and demonstrated
their use in examples. Actual semantical meaning wasn't defined.
In addition, NIS and NIS+ never had any RFC defined for them.
Is there a way to get the RFC-defined behavior from IPA and SSSD?
Can you point me to what you call RFC-defined behavior? Because I don't
see RFC defining a behavior but rather a storage format (which is
suboptimal but that's another story).
We don’t actually have a user case for pairing. We just need a host
list. So for the moment the plan is to add hosts with nisdomain=, and
use nslcd in nsswitch.conf for net groups on the Linux systems that are
NFS servers.
Right now IPA allows you to associate a hostgroup with a specific
netgroup and schema compat plugin will automatically generate triples
expressing this set. However, as I showed above, SSSD doesn't actually
use this compatibility information at all. IPA provider sets netgroup
search base to cn=ng,cn=alt,$SUFFIX, not cn=ng,cn=compat,$SUFFIX, so
RFC2307bis-specific details are irrelevant in the case IPA provider is
used.
I don’t have any specific use case for distinguishing between space
and
-. But the spec says they mean something different. I don’t know why
you would adopt a representation that doesn’t allow for every valid
triple.
I believe we do allow that and compat plugin actually generates them --
except for empty nisDomainName attribute -- for which I provided a
possible solution in my previous email.
I'm yet to see your actual example. Let us set SSSD bug aside here.
Please show a sequence of 'ipa netgroup-*' commands that demonstrate
configuration that is not generating a set of triples you need in the
compat tree. Will that set be generated with a solution I provided in
the previous email?
If we can get these samples, I'm sure it will be easy for Pavel to
provide SSSD fix as well, and these samples can be then used to generate
a test cases to prevent possible regressions in future.
On Nov 13, 2017, at 4:25 AM, Pavel Březina
<pbrezina@redhat.com<mailto:pbrezina@redhat.com>> wrote:
Can you send us some example of what you are trying to achieve and what
does not work? I'm also ccing Alexander Bokovoy to see why IPA adds
somewhere dash and somewhere blanks.
--
/ Alexander Bokovoy
11:15 a.m.
On ma, 13 marras 2017, Charles Hedrick wrote:
While we’re on this subject, it would be useful for IPA to support
netgroup.byhost. That would give signifiant advantages with Netapp. If
that is supported, Netapp will look up the netgroups for a host every
time a mount is done. Without it, they consider that reloading the
whole net group file is too inefficient, so they depend upon a cache
whose normal TTL is a day.
I'm confused here.
We have:
- LDAP: native netgroups in IPA, used by SSSD IPA provider directly
- LDAP: compatibility tree that exposes native IPA netgroups as RFC2307bis
objects with no way to set blank nisDomainName right now
- NIS protocol: NIS triplets generated based on the compat tree
netgroups.
The latter provides three netgroup maps:
- netgroup
- netgroup.byhost
- netgroup.byuser
The are already exist but both netgroup.byhost and netgroup.byuser are
not utilized by glibc, so they may have regressed (I see them defined in
the code).
Which of the implementation do you use? Did you configure your Netapp
filer to look up LDAP in cn=ng,cn=compat,$SUFFIX or is it using NIS
protocol?
> On Nov 13, 2017, at 4:25 AM, Pavel Březina <pbrezina(a)redhat.com> wrote:
>
> On 11/08/2017 11:47 PM, Charles Hedrick wrote:
>> In my opinion the whole rfc3704bis implementation of net groups is wonky.
>>
>> This isn’t the only problem. Why is there a distinction between internal and
external hosts? Suppose I add an external host to a net group, and later do ipa host-add
for it. If the distinction actually matters I’d expect the system to turn the external
host entry into an internal host entry. But it doesn’t.
>>
>> In principle there’s a difference between blank and -, but the ipa implementation
always produces - for missing user and host and blank for missing domain name.
>>
>> I’d really rather see the system just store the triples rather than doing a
complex mapping going in and out.
>>
>>
>>> On Nov 8, 2017, at 5:08 PM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
>>>
>>> Pavel, does this sound like the bug you were looking at wrt sudo lately?
>>>
>>> On Wed, Nov 08, 2017 at 09:46:25PM +0000, Charles Hedrick wrote:
>>>> Netapp wants the domain field to be blank. That leaves us a problem
that’s hard to solve.
>>>>
>>>> On Nov 8, 2017, at 4:41 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
>>>>
>>>> OK, I see what’s going on, but it looks like a bug.
>>>>
>>>> We mostly use net groups for hosts. In NIS our entries like like
(hostname,,) You can put that into IPA by specifying NISdomain=, i.e. blank domain name.
However if you do that, getent shows no entries. That is, entries with blank hostname are
ignored. I claim this is a bug, since for a host entry there’s no reason to specify a
domain.
>>>>
>>>> I also found that specifying
>>>>
>>>>
ipa_netgroup_domain=cs.rutgers.edu<https://na01.safelinks.protection.o...
>>>>
>>>> causes no net groups to display, even ones whose domain is
cs.rutgers.edu<https://na01.safelinks.protection.outlook.com/?url=http...;.
This also looks like a bug.
>>>>
>>>> On Nov 8, 2017, at 3:53 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
>>>>
>>>> We want to move our net groups from NIS to IPA. I’ve loaded the groups.
They’re visible on a system that uses nslcd pointed at the IPA server. But the systems
that use SSSD for authentication don’t show anything. The net groups all show as
undefined.
>>>>
>>>> I’ve turned on debugging and looked at the LDAP logs. It does the right
quotes and the log says it extracts the members. But they don’t show up.
>>>>
>>>> Any idea where to look?
>
> Can you send us some example of what you are trying to achieve and what does not
work? I'm also ccing Alexander Bokovoy to see why IPA adds somewhere dash and
somewhere blanks.
>
--
/ Alexander Bokovoy
11:31 a.m.
So, the real issue is SSSD's inability to support empty netgroup
domain
part, right?
Yes, that’s the real bug. It doesn’t appear that the other issues are serious, as I can’t
find any real appiication that uses the NIS entries as triples.
The sssd problem is moderately serious for me. I don’t want to put in an arbitrary NIS
domain name for a system that doesn’t use NIS, because even if it works on the Netapp now,
I’d be depending upon undocumented behavior or I’d have to give it a dummy NIS domain. I’m
reluctant to tell the Netapp that it’s in a NIS domain that doesn’t exist. Who knows what
it would do?
It could also be an issue for transition. Consider a situation like ours where we’re
combining a number of NIS domains into a single IPA domain. While we could work around it,
it would be cleanest for our netgroup entries not to have a domain name, so it’s clear
that they apply to all NIS domains. (In fact our transition has gone far enough that this
isn’t a real problem. We’re decommissioning NIS pretty rapidly.)
Can you point me to what you call RFC-defined behavior? Because I
don't
see RFC defining a behavior but rather a storage format (which is
suboptimal but that's another story).
I guess it depends upon how you understand the RFC. Clearly it doesn’t matter how you
store data as long as you present it to the application the way the RFC specifies. But in
fact an LDAP query simply presents it as stored. So you have to use the compat tree to get
the defined results. Even there, there are triples that would be valid under the RFC that
you can’t generate. I agree that there may be no actual applications that would do it, but
that doesn’t seem like something you want your directory services dictating.
In principle according to the documentation we could write an application that checks
access using both user and host from a triple. E.g.
(host1, user1, domain1)
would authorize applications running in domain1 to accept login from user1@host1. You
can’t reliably generate triples like that, because the association between user and host
isn’t stored. You can fake it, but the first time a host is removed, or for mixes of
internal and external hosts, you’ll get unexpected behavior.
Since no known applications uses this, it’s probably not a serious bug, but I wouldn’t
have created a design that disallows it.
> On Nov 13, 2017, at 11:44 AM, Alexander Bokovoy <abokovoy(a)redhat.com> wrote:
>
> On ma, 13 marras 2017, Charles Hedrick wrote:
>> Sure. We use netgroups for /etc/exports. The most natural format for triples is
>>
>> (host,,)
>>
>> That’s the format Netapp documents. By default, ipa netgroup-add-member uses
>>
>> (host,-,domain)
>>
>> where domain seems to come from our Kerberos domain. Netapp
>> documentation requests leaving that field blank, though some
>> documentation suggests that if it’s filled in, they will ignore triples
>> where the domain doesn’t match the Netapp’s domain. We are no longer
>> using NIS, so as far as we know, the Netapp doesn’t have a NIS domain.
>> I think it’s safest to leave the field blank.
> IPA sets NIS domain by default to its primary domain (equal to IPA
> realm in lower case). This is just a default value.
>
>> I can do this in IPA. —nisdomain= will leave it blank. That results in
>>
>> (host,-,)
>>
>> That works with the Netapp. (I haven’t actually tried putting a domain in.)
>>
>> Unfortunately it won’t work with sssd, because sssd won’t show any
>> triples if the nisdomain isn’t set for that net group.
So, the real issue is SSSD's inability to support empty netgroup
domain
part, right?
>
> This is the code in ipa_netgr_process_all():
> ...
> ret = sysdb_attrs_get_string(state->netgroups[i], SYSDB_NETGROUP_DOMAIN,
> &domain);
> if (ret != EOK) {
> goto done;
> }
> ...
>
> DEBUG(SSSDBG_TRACE_INTERNAL, "Putting together triples of "
> "netgroup %d\n", i);
> for (j = 0; j < uids_count; j++) {
> for (k = 0; k < hosts_count; k++) {
> triple = talloc_asprintf(state, "(%s,%s,%s)",
> hosts[k], uids[j],
> domain);
> if (triple == NULL) {
> ret = ENOMEM;
> goto done;
> }
>
> ret = sysdb_attrs_add_string(state->netgroups[i],
> SYSDB_NETGROUP_TRIPLE,
> triple);
> if (ret != EOK) {
> goto done;
> }
> }
> }
>
>
> So, if no domain is retrieved, no netgroup triple is generated by SSSD
> IPA provider. Note that this does not utilize compatibility netgroups
> subtree as generated by schema compatibility plugin (in
> cn=ng,cn=compat,$SUFFIX) but instead works directly with IPA netgroups.
>
> So our discussion about RFC2307bis is not really applicable here. If we
> consider the use case with a blank nisDomainName a valid one (and I
> think we can consider it), the code above needs to be fixed to allow
> such use. It is a fairly simple fix.
>
>> In general I don’t understand why IPA and sssd are using a nonstandard
>> representation of net groups. Why not just a collection of triples and
>> subgroups? As far as I can see RFC 2307bis has the same schema for net
>> groups as RFC 2307.
>>
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ie....
Is there a
>> later version of RFC 2307bis that I haven’t been able to find? Draft 2
>> is the latest at
tools.ietf.org<https://na01.safelinks.protection.outlook.com/?url=http...;.
>>
>> ( 1.3.6.1.1.1.2.8 NAME 'nisNetgroup' SUP top STRUCTURAL
>> DESC 'Abstraction of a netgroup. May refer to other
>> netgroups'
>> MUST cn
>> MAY ( nisNetgroupTriple $ memberNisNetgroup $ description ) )
>>
>> The representation used by IPA seems to be non-standard. I’d expect IPA
>> and sssd to allow me to add any triple I want that’s valid in a normal
>> net group file.
> You can read (old) explanation on why IPA has schema as it has:
>
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.free...
>
>
>> One problem with the IPA representation is that there are no actual
>> triples. There’s a list of hosts, a list of users, and a domain. Not
>> all triples can be represented that way. Something like (host1, user1,)
>> (host2, user2,)
>> has to be represented by a user list of user1, user2 and a host list of
>> host1, host2. But the pairing isn’t always well defined. E.g. I added
>> to that group an external host3 and an internal user3. I ended up with
>>
>> (host3, user1,)
>> (host1, user2,)
>> (host2, user3,)
>>
>> I don’t know whether there are applications that use the pairing of
>> hosts and users, but the original design was intended to support that.
>> With IPA it’s dangerous, because I have to know just how IPA generates
>> the triples from the entires.
> Frankly speaking, original RFC2307bis design had very little explanation
> on the actual semantics. It just listed attributes and demonstrated
> their use in examples. Actual semantical meaning wasn't defined.
>
> In addition, NIS and NIS+ never had any RFC defined for them.
>
>> Is there a way to get the RFC-defined behavior from IPA and SSSD?
Can you point me to what you call RFC-defined behavior? Because I
don't
see RFC defining a behavior but rather a storage format (which is
suboptimal but that's another story).
>
>
>> We don’t actually have a user case for pairing. We just need a host
>> list. So for the moment the plan is to add hosts with nisdomain=, and
>> use nslcd in nsswitch.conf for net groups on the Linux systems that are
>> NFS servers.
> Right now IPA allows you to associate a hostgroup with a specific
> netgroup and schema compat plugin will automatically generate triples
> expressing this set. However, as I showed above, SSSD doesn't actually
> use this compatibility information at all. IPA provider sets netgroup
> search base to cn=ng,cn=alt,$SUFFIX, not cn=ng,cn=compat,$SUFFIX, so
> RFC2307bis-specific details are irrelevant in the case IPA provider is
> used.
>
>> I don’t have any specific use case for distinguishing between space and
>> -. But the spec says they mean something different. I don’t know why
>> you would adopt a representation that doesn’t allow for every valid
>> triple.
> I believe we do allow that and compat plugin actually generates them --
> except for empty nisDomainName attribute -- for which I provided a
> possible solution in my previous email.
>
> I'm yet to see your actual example. Let us set SSSD bug aside here.
> Please show a sequence of 'ipa netgroup-*' commands that demonstrate
> configuration that is not generating a set of triples you need in the
> compat tree. Will that set be generated with a solution I provided in
> the previous email?
>
> If we can get these samples, I'm sure it will be easy for Pavel to
> provide SSSD fix as well, and these samples can be then used to generate
> a test cases to prevent possible regressions in future.
>
>>
>> On Nov 13, 2017, at 4:25 AM, Pavel Březina
<pbrezina@redhat.com<mailto:pbrezina@redhat.com>> wrote:
>>
>> Can you send us some example of what you are trying to achieve and what
>> does not work? I'm also ccing Alexander Bokovoy to see why IPA adds
>> somewhere dash and somewhere blanks.
>>
>
> --
> / Alexander Bokovoy
11:51 a.m.
On ma, 13 marras 2017, Charles Hedrick wrote:
> So, the real issue is SSSD's inability to support empty
netgroup domain
> part, right?
Yes, that’s the real bug. It doesn’t appear that the other issues are
serious, as I can’t find any real appiication that uses the NIS entries
as triples.
The sssd problem is moderately serious for me. I don’t want to put in
an arbitrary NIS domain name for a system that doesn’t use NIS, because
even if it works on the Netapp now, I’d be depending upon undocumented
behavior or I’d have to give it a dummy NIS domain. I’m reluctant to
tell the Netapp that it’s in a NIS domain that doesn’t exist. Who knows
what it would do?
It could also be an issue for transition. Consider a situation like
ours where we’re combining a number of NIS domains into a single IPA
domain. While we could work around it, it would be cleanest for our
netgroup entries not to have a domain name, so it’s clear that they
apply to all NIS domains. (In fact our transition has gone far enough
that this isn’t a real problem. We’re decommissioning NIS pretty
rapidly.)
Sure. Could you please file a bug about it (if not yet filed)?
> Can you point me to what you call RFC-defined behavior? Because I don't
> see RFC defining a behavior but rather a storage format (which is
> suboptimal but that's another story).
I guess it depends upon how you understand the RFC. Clearly it doesn’t
matter how you store data as long as you present it to the application
the way the RFC specifies. But in fact an LDAP query simply presents it
as stored. So you have to use the compat tree to get the defined
results. Even there, there are triples that would be valid under the
RFC that you can’t generate. I agree that there may be no actual
applications that would do it, but that doesn’t seem like something you
want your directory services dictating.
In principle according to the documentation we could write an
application that checks access using both user and host from a triple.
E.g.
(host1, user1, domain1)
would authorize applications running in domain1 to accept login from
user1@host1. You can’t reliably generate triples like that, because the
association between user and host isn’t stored. You can fake it, but
the first time a host is removed, or for mixes of internal and external
hosts, you’ll get unexpected behavior.
Not sure why you keep saying that.
# ipa netgroup-add netgroup-foo --nisdomain=xs.ipa.cool
-----------------------------
Added netgroup "netgroup-foo"
-----------------------------
Netgroup name: netgroup-foo
NIS domain name: xs.ipa.cool
IPA unique ID: dafcbb66-c89a-11e7-b3e5-001a4a62eb77
# ipa netgroup-add-member netgroup-foo --users=ab --hosts=raup
Netgroup name: netgroup-foo
NIS domain name: xs.ipa.cool
Member User: ab
Member Host: raup.xs.ipa.cool
-------------------------
Number of members added 2
-------------------------
# ldapsearch -x -b cn=ng,cn=compat,dc=xs,dc=ipa,dc=cool cn=netgroup-foo
dn: cn=netgroup-foo,cn=ng,cn=compat,dc=xs,dc=ipa,dc=cool
objectClass: nisNetgroup
objectClass: top
nisNetgroupTriple: (raup.xs.ipa.cool,ab,xs.ipa.cool)
cn: netgroup-foo
As you can see, there is a pretty standard for IPA way of creating an
object and adding members to it. Many other types of objects follow the
same approach. More to that, compat tree in LDAP has exactly what you
want.
Was it unclear to you that 'ipa netgroup-add-member' is the command to
use? See 'ipa help netgroup' for details on all commands we have about
netgroups.
Since no known applications uses this, it’s probably not a serious
bug,
but I wouldn’t have created a design that disallows it.
> On Nov 13, 2017, at 11:44 AM, Alexander Bokovoy <abokovoy(a)redhat.com> wrote:
>
> On ma, 13 marras 2017, Charles Hedrick wrote:
>> Sure. We use netgroups for /etc/exports. The most natural format for triples is
>>
>> (host,,)
>>
>> That’s the format Netapp documents. By default, ipa netgroup-add-member uses
>>
>> (host,-,domain)
>>
>> where domain seems to come from our Kerberos domain. Netapp
>> documentation requests leaving that field blank, though some
>> documentation suggests that if it’s filled in, they will ignore triples
>> where the domain doesn’t match the Netapp’s domain. We are no longer
>> using NIS, so as far as we know, the Netapp doesn’t have a NIS domain.
>> I think it’s safest to leave the field blank.
> IPA sets NIS domain by default to its primary domain (equal to IPA
> realm in lower case). This is just a default value.
>
>> I can do this in IPA. —nisdomain= will leave it blank. That results in
>>
>> (host,-,)
>>
>> That works with the Netapp. (I haven’t actually tried putting a domain in.)
>>
>> Unfortunately it won’t work with sssd, because sssd won’t show any
>> triples if the nisdomain isn’t set for that net group.
> So, the real issue is SSSD's inability to support empty netgroup domain
> part, right?
>
> This is the code in ipa_netgr_process_all():
> ...
> ret = sysdb_attrs_get_string(state->netgroups[i], SYSDB_NETGROUP_DOMAIN,
> &domain);
> if (ret != EOK) {
> goto done;
> }
> ...
>
> DEBUG(SSSDBG_TRACE_INTERNAL, "Putting together triples of "
> "netgroup %d\n", i);
> for (j = 0; j < uids_count; j++) {
> for (k = 0; k < hosts_count; k++) {
> triple = talloc_asprintf(state, "(%s,%s,%s)",
> hosts[k], uids[j],
> domain);
> if (triple == NULL) {
> ret = ENOMEM;
> goto done;
> }
>
> ret = sysdb_attrs_add_string(state->netgroups[i],
> SYSDB_NETGROUP_TRIPLE,
> triple);
> if (ret != EOK) {
> goto done;
> }
> }
> }
>
>
> So, if no domain is retrieved, no netgroup triple is generated by SSSD
> IPA provider. Note that this does not utilize compatibility netgroups
> subtree as generated by schema compatibility plugin (in
> cn=ng,cn=compat,$SUFFIX) but instead works directly with IPA netgroups.
>
> So our discussion about RFC2307bis is not really applicable here. If we
> consider the use case with a blank nisDomainName a valid one (and I
> think we can consider it), the code above needs to be fixed to allow
> such use. It is a fairly simple fix.
>
>> In general I don’t understand why IPA and sssd are using a nonstandard
>> representation of net groups. Why not just a collection of triples and
>> subgroups? As far as I can see RFC 2307bis has the same schema for net
>> groups as RFC 2307.
>>
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ie....
Is there a
>> later version of RFC 2307bis that I haven’t been able to find? Draft 2
>> is the latest at
tools.ietf.org<https://na01.safelinks.protection.outlook.com/?url=http...;.
>>
>> ( 1.3.6.1.1.1.2.8 NAME 'nisNetgroup' SUP top STRUCTURAL
>> DESC 'Abstraction of a netgroup. May refer to other
>> netgroups'
>> MUST cn
>> MAY ( nisNetgroupTriple $ memberNisNetgroup $ description ) )
>>
>> The representation used by IPA seems to be non-standard. I’d expect IPA
>> and sssd to allow me to add any triple I want that’s valid in a normal
>> net group file.
> You can read (old) explanation on why IPA has schema as it has:
>
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.free...
>
>
>> One problem with the IPA representation is that there are no actual
>> triples. There’s a list of hosts, a list of users, and a domain. Not
>> all triples can be represented that way. Something like (host1, user1,)
>> (host2, user2,)
>> has to be represented by a user list of user1, user2 and a host list of
>> host1, host2. But the pairing isn’t always well defined. E.g. I added
>> to that group an external host3 and an internal user3. I ended up with
>>
>> (host3, user1,)
>> (host1, user2,)
>> (host2, user3,)
>>
>> I don’t know whether there are applications that use the pairing of
>> hosts and users, but the original design was intended to support that.
>> With IPA it’s dangerous, because I have to know just how IPA generates
>> the triples from the entires.
> Frankly speaking, original RFC2307bis design had very little explanation
> on the actual semantics. It just listed attributes and demonstrated
> their use in examples. Actual semantical meaning wasn't defined.
>
> In addition, NIS and NIS+ never had any RFC defined for them.
>
>> Is there a way to get the RFC-defined behavior from IPA and SSSD?
> Can you point me to what you call RFC-defined behavior? Because I don't
> see RFC defining a behavior but rather a storage format (which is
> suboptimal but that's another story).
>
>
>> We don’t actually have a user case for pairing. We just need a host
>> list. So for the moment the plan is to add hosts with nisdomain=, and
>> use nslcd in nsswitch.conf for net groups on the Linux systems that are
>> NFS servers.
> Right now IPA allows you to associate a hostgroup with a specific
> netgroup and schema compat plugin will automatically generate triples
> expressing this set. However, as I showed above, SSSD doesn't actually
> use this compatibility information at all. IPA provider sets netgroup
> search base to cn=ng,cn=alt,$SUFFIX, not cn=ng,cn=compat,$SUFFIX, so
> RFC2307bis-specific details are irrelevant in the case IPA provider is
> used.
>
>> I don’t have any specific use case for distinguishing between space and
>> -. But the spec says they mean something different. I don’t know why
>> you would adopt a representation that doesn’t allow for every valid
>> triple.
> I believe we do allow that and compat plugin actually generates them --
> except for empty nisDomainName attribute -- for which I provided a
> possible solution in my previous email.
>
> I'm yet to see your actual example. Let us set SSSD bug aside here.
> Please show a sequence of 'ipa netgroup-*' commands that demonstrate
> configuration that is not generating a set of triples you need in the
> compat tree. Will that set be generated with a solution I provided in
> the previous email?
>
> If we can get these samples, I'm sure it will be easy for Pavel to
> provide SSSD fix as well, and these samples can be then used to generate
> a test cases to prevent possible regressions in future.
>
>>
>> On Nov 13, 2017, at 4:25 AM, Pavel Březina
<pbrezina@redhat.com<mailto:pbrezina@redhat.com>> wrote:
>>
>> Can you send us some example of what you are trying to achieve and what
>> does not work? I'm also ccing Alexander Bokovoy to see why IPA adds
>> somewhere dash and somewhere blanks.
>>
>
> --
> / Alexander Bokovoy
--
/ Alexander Bokovoy
11:56 a.m.
The netapp is using LDAP with RFC2307 for all name service. That include users, groups,
and netgroups.
What they are asking for is for LDAP to implement netgroup.byhost. It appears that AD does
this. As far as I can tell, they are looking for nisMapName=netgroup.byhost accessed via
LDAP.
I hadn’t thought about asking IPA to emulate NIS. If that would efficiently implement the
netgroup.byhost NIS map, maybe it’s the way to go. We don’t currently have NIS enabled for
the netapp. We’re using RFC2307 for users and groups. Netapp supports ns-switch, so it
sounds like we could use NIS for just netgroups. Is that what you’d suggest?
On Nov 13, 2017, at 12:15 PM, Alexander Bokovoy
<abokovoy(a)redhat.com> wrote:
On ma, 13 marras 2017, Charles Hedrick wrote:
> While we’re on this subject, it would be useful for IPA to support
> netgroup.byhost. That would give signifiant advantages with Netapp. If
> that is supported, Netapp will look up the netgroups for a host every
> time a mount is done. Without it, they consider that reloading the
> whole net group file is too inefficient, so they depend upon a cache
> whose normal TTL is a day.
I'm confused here.
We have:
- LDAP: native netgroups in IPA, used by SSSD IPA provider directly
- LDAP: compatibility tree that exposes native IPA netgroups as RFC2307bis
objects with no way to set blank nisDomainName right now
- NIS protocol: NIS triplets generated based on the compat tree
netgroups.
The latter provides three netgroup maps:
- netgroup
- netgroup.byhost
- netgroup.byuser
The are already exist but both netgroup.byhost and netgroup.byuser are
not utilized by glibc, so they may have regressed (I see them defined in
the code).
Which of the implementation do you use? Did you configure your Netapp
filer to look up LDAP in cn=ng,cn=compat,$SUFFIX or is it using NIS
protocol?
>
>
>> On Nov 13, 2017, at 4:25 AM, Pavel Březina <pbrezina(a)redhat.com> wrote:
>>
>> On 11/08/2017 11:47 PM, Charles Hedrick wrote:
>>> In my opinion the whole rfc3704bis implementation of net groups is wonky.
>>>
>>> This isn’t the only problem. Why is there a distinction between internal and
external hosts? Suppose I add an external host to a net group, and later do ipa host-add
for it. If the distinction actually matters I’d expect the system to turn the external
host entry into an internal host entry. But it doesn’t.
>>>
>>> In principle there’s a difference between blank and -, but the ipa
implementation always produces - for missing user and host and blank for missing domain
name.
>>>
>>> I’d really rather see the system just store the triples rather than doing a
complex mapping going in and out.
>>>
>>>
>>>> On Nov 8, 2017, at 5:08 PM, Jakub Hrozek <jhrozek(a)redhat.com>
wrote:
>>>>
>>>> Pavel, does this sound like the bug you were looking at wrt sudo
lately?
>>>>
>>>> On Wed, Nov 08, 2017 at 09:46:25PM +0000, Charles Hedrick wrote:
>>>>> Netapp wants the domain field to be blank. That leaves us a problem
that’s hard to solve.
>>>>>
>>>>> On Nov 8, 2017, at 4:41 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
>>>>>
>>>>> OK, I see what’s going on, but it looks like a bug.
>>>>>
>>>>> We mostly use net groups for hosts. In NIS our entries like like
(hostname,,) You can put that into IPA by specifying NISdomain=, i.e. blank domain name.
However if you do that, getent shows no entries. That is, entries with blank hostname are
ignored. I claim this is a bug, since for a host entry there’s no reason to specify a
domain.
>>>>>
>>>>> I also found that specifying
>>>>>
>>>>>
ipa_netgroup_domain=cs.rutgers.edu<https://na01.safelinks.protection.o...
>>>>>
>>>>> causes no net groups to display, even ones whose domain is
cs.rutgers.edu<https://na01.safelinks.protection.outlook.com/?url=http...;.
This also looks like a bug.
>>>>>
>>>>> On Nov 8, 2017, at 3:53 PM, Charles Hedrick
<hedrick@rutgers.edu<mailto:hedrick@rutgers.edu>> wrote:
>>>>>
>>>>> We want to move our net groups from NIS to IPA. I’ve loaded the
groups. They’re visible on a system that uses nslcd pointed at the IPA server. But the
systems that use SSSD for authentication don’t show anything. The net groups all show as
undefined.
>>>>>
>>>>> I’ve turned on debugging and looked at the LDAP logs. It does the
right quotes and the log says it extracts the members. But they don’t show up.
>>>>>
>>>>> Any idea where to look?
>>
>> Can you send us some example of what you are trying to achieve and what does not
work? I'm also ccing Alexander Bokovoy to see why IPA adds somewhere dash and
somewhere blanks.
>>
>
--
/ Alexander Bokovoy
12:11 p.m.
On Nov 13, 2017, at 12:51 PM, Alexander Bokovoy
<abokovoy(a)redhat.com> wrote:
Not sure why you keep saying that.
Your example showed only one entry. Suppose I want to generate
(host1, user1,)
(host2, user2,)
I can use
ipa netgroup-add-member —hosts=host1 —users=user1
ipa netgroup-add-member —hosts=host2 —users=user2
But the results aren’t always as expected
Failure mode 1: deleting a host
ipa netgroup-add-member testng --hosts=www.rutgers.edu --users=hedrick
ipa netgroup-add-member testng --hosts=c217.cs.rutgers.edu --users=clh
nisNetgroupTriple: (www.rutgers.edu,hedrick,cs.rutgers.edu)
nisNetgroupTriple: (c217.cs.rutgers.edu,clh,cs.rutgers.edu)
ipa host-del www.rutgers.edu
nisNetgroupTriple: (c217.cs.rutgers.edu,hedrick,cs.rutgers.edu)
nisNetgroupTriple: (-,clh,cs.rutgers.edu)
Note that hedrick is now paired with c217, not www.
Failure mode 2: external host mixed with internal
ipa netgroup-add-member testng --users=dsmith --hosts=rci.rutgers.edu
nisNetgroupTriple: (rci.rutgers.edu,hedrick,cs.rutgers.edu)
nisNetgroupTriple: (c217.cs.rutgers.edu,clh,cs.rutgers.edu)
nisNetgroupTriple: (-,dsmith,cs.rutgers.edu)
Probably not what I intended. The problem is that external hosts are shown first, while
the user is added last.
1:19 p.m.
On ma, 13 marras 2017, Charles Hedrick wrote:
The netapp is using LDAP with RFC2307 for all name service. That
include users, groups, and netgroups.
What they are asking for is for LDAP to implement netgroup.byhost. It
appears that AD does this. As far as I can tell, they are looking for
nisMapName=netgroup.byhost accessed via LDAP.
I hadn’t thought about asking IPA to emulate NIS. If that would
efficiently implement the netgroup.byhost NIS map, maybe it’s the way
to go. We don’t currently have NIS enabled for the netapp. We’re using
RFC2307 for users and groups. Netapp supports ns-switch, so it sounds
like we could use NIS for just netgroups. Is that what you’d suggest?
No, I'm
not suggesting that. I was confused on what is your exact
configuration because you conflated many things together and it wasn't
clear at all what is in use.
I don't think we have any support for nisMapName attribute at all.
--
/ Alexander Bokovoy
2355
days inactive
2360
days old
sssd-users@lists.fedorahosted.org
19 comments
6 participants
participants (6)
-
Alexander Bokovoy -
Charles Hedrick -
Jakub Hrozek -
Lukas Slebodnik -
Michael Ströder -
Pavel Březina