Strange behaviour with groups

[JOHE (John Hearns)]

I am seeing some very strange behaviour.

Very often when I issue the command 'groups   username' then only the local groups in /etc/group are returned.

Issue the command again then the list with the local groups plus the AD groups is returned.

In /etc/nsswitch.conf                 group:          files sss

I am altering the parameter ad_enable_gc to  False but this happened with is set to True also.

Any ideas please?

[Jakub Hrozek]

On Fri, Jun 01, 2018 at 11:31:55AM +0000, JOHE (John Hearns) wrote:
> I am seeing some very strange behaviour.
>
> Very often when I issue the command 'groups   username' then only the local groups in /etc/group are returned.
>
> Issue the command again then the list with the local groups plus the AD groups is returned.
>
> In /etc/nsswitch.conf                 group:          files sss
>
> I am altering the parameter ad_enable_gc to  False but this happened with is set to True also.
>
> Any ideas please?

Not without logs that capture the issue, sorry.

See https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html

[John Hearns]

Jakub, a genuine thankyou for the response.

I have logs of course, at a high debug level. I find that they are very
verbose.
Do you have a suggestion please as to
(a)  which of the logs to look at for this problem?  I guess sssd_nss.log
(b) any particular patterns I should look out for?

On 1 June 2018 at 14:37, Jakub Hrozek  wrote:
> On Fri, Jun 01, 2018 at 11:31:55AM +0000, JOHE (John Hearns) wrote:
> > I am seeing some very strange behaviour.
> >
> > Very often when I issue the command 'groups   username' then only the
>
> local groups in /etc/group are returned.
> > Issue the command again then the list with the local groups plus the AD
>
> groups is returned.
> > In /etc/nsswitch.conf                 group:          files sss
> >
> > I am altering the parameter ad_enable_gc to  False but this happened
>
> with is set to True also.
> > Any ideas please?
>
> Not without logs that capture the issue, sorry.
>
> See https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html
> _______________________________________________
> sssd-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/sssd-users@
> lists.fedorahosted.org/message/XSOSASZDGEELE7EXD5Z3BYU24GTP7CEG/

[Jakub Hrozek]

> On 1 Jun 2018, at 15:10, John Hearns  wrote:
>
> Jakub, a genuine thankyou for the response.
>
> I have logs of course, at a high debug level. I find that they are very verbose.
> Do you have a suggestion please as to 
> (a)  which of the logs to look at for this problem?  I guess sssd_nss.log

Yes, I normally try to note the time when an issue happens and look first into the sssd_nss log and then at the matching entries in the domain log.
> (b) any particular patterns I should look out for?

The “id” command translates into calling “initgroups”, so I would look into calls matching “initgr” in the logs.

By the way, you mentioned the user is a member of local groups. Is the user also present in passwd or only in LDAP?
> On 1 June 2018 at 14:37, Jakub Hrozek  wrote:
> On Fri, Jun 01, 2018 at 11:31:55AM +0000, JOHE (John Hearns) wrote:
> > I am seeing some very strange behaviour.
> >
> > Very often when I issue the command 'groups   username' then only the local groups in /etc/group are returned.
> >
> > Issue the command again then the list with the local groups plus the AD groups is returned.
> >
> > In /etc/nsswitch.conf                 group:          files sss
> >
> > I am altering the parameter ad_enable_gc to  False but this happened with is set to True also.
> >
> > Any ideas please?
>
> Not without logs that capture the issue, sorry.
>
> See https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html
> _______________________________________________
> sssd-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]....
>
> sssd-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]....