Bug 1002651

Summary:	[RFE] It should be possible to use uid/gid defined in AD instead of SIDs
Product:	Red Hat Enterprise Linux 7	Reporter:	Dmitri Pal <dpal>
Component:	ipa	Assignee:	Martin Kosek <mkosek>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Namita Soman <nsoman>
Severity:	unspecified	Docs Contact:
Priority:	medium
Version:	7.0	CC:	abokovoy, rcritten, sgoveas, tbabej
Target Milestone:	rc	Keywords:	FutureFeature
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-3.3.1-1.el7	Doc Type:	Release Note
Doc Text:	Cross-realm trusts support in IdM allows to get POSIX user or group ID attributes from Active Directory IdM implementation of cross-realm trusts to Active Directory supports existing POSIX user and group ID attributes in AD. When explicit mappings are not defined at Active Directory side, algorithmic mapping based on user or group Security Identitifier (SID) is applied.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-06-13 10:34:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Dmitri Pal 2013-08-29 16:31:05 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/2904

The first implementation of the trusts solution takes SID of the user entry and uses a special algorithm to create unique UID for the user. The similar approach is used for GID. This works fine for the deployments that do not have POSIX attributes defined in AD. In the cases when POSIX attributes are defined in AD there are usually already clients that leverage these attributes so switching to the SID->UIS/GID model is not acceptable. Instead IPA and SSSD should be able to respect the POSIX attributes defined in the AD.

SSSD ticket https://fedorahosted.org/sssd/ticket/1408

Comment 1 Tomas Babej 2013-08-30 13:47:59 UTC

For detailed reference, please see:

https://fedorahosted.org/freeipa/ticket/2904#comment:17

Comment 2 Rob Crittenden 2013-08-30 13:57:49 UTC

master:

d2b943f08b6fd49b7adccbf6fa84e7d63d8f08b1
1c0f0517f521cd36e407f6038e6eefdaf3441b3
ddb39570115b6b6cca71d66e9bf1a8463f599514
e4437a3e7ffcb547a00a70614804dc35fefd630e
84b2269589c115cae2d2bcec32fec602143fc42e
17c7d46c254de8301a1c328155d245631d5c03e4

Comment 4 Steeve Goveas 2014-01-29 07:45:10 UTC

Verified in version
ipa-server-3.3.3-13.el7.x86_64

* From automation run with range type ipa-ad-trust-posix

[2014-01-23T15:06:45Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.OpenSSHTransport] <INFO>: RUN ['ipa', 'trust-add', '--type', 'ad', 'adposix.qe', '--admin', 'Administrator', '--password', '--range-type', 'ipa-ad-trust-posix']
[2014-01-23T15:06:45Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44] <DEBUG>: RUN ['ipa', 'trust-add', '--type', 'ad', 'adposix.qe', '--admin', 'Administrator', '--password', '--range-type', 'ipa-ad-trust-posix']
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>: ---------------------------------------------------
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>: Added Active Directory trust for realm "adposix.qe"
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>: ---------------------------------------------------
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   Realm name: adposix.qe
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   Domain NetBIOS name: ADPOSIX
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   Domain Security Identifier: S-1-5-21-3655340000-3880942204-3419777279
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   SID blacklist incoming: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16, S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   SID blacklist outgoing: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16, S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   Trust direction: Two-way trust
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   Trust type: Active Directory domain
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   Trust status: Established and verified
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44] <DEBUG>: Exit code: 0

.[2014-01-23T15:07:27Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.OpenSSHTransport] <INFO>: RUN ['ipa', 'idrange-show', 'ADPOSIX.QE_id_range', '--all', '--raw']
[2014-01-23T15:07:27Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52] <DEBUG>: RUN ['ipa', 'idrange-show', 'ADPOSIX.QE_id_range', '--all', '--raw']
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   dn: cn=ADPOSIX.QE_id_range,cn=ranges,cn=etc,dc=testrelm,dc=com
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   cn: ADPOSIX.QE_id_range
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   ipaBaseID: 10000
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   ipaBaseRID: 0
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   ipaIDRangeSize: 200000
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   ipaNTTrustedDomainSID: S-1-5-21-3655340000-3880942204-3419777279
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   ipaRangeType: ipa-ad-trust-posix
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   objectClass: ipaIDrange
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   objectClass: ipatrustedaddomainrange
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52] <DEBUG>: Exit code: 0
.[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.OpenSSHTransport] <INFO>: RUN ['getent', 'passwd', 'testuser']
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd53] <DEBUG>: RUN ['getent', 'passwd', 'testuser']
[2014-01-23T15:07:33Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd53.out] <DEBUG>: testuser:*:10042:10047:Test User:/home/testuser:/bin/sh
[2014-01-23T15:07:33Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd53] <DEBUG>: Exit code: 0
.[2014-01-23T15:07:33Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.OpenSSHTransport] <INFO>: RUN ['getent', 'passwd', 'nonposixuser']
[2014-01-23T15:07:33Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd54] <DEBUG>: RUN ['getent', 'passwd', 'nonposixuser']
[2014-01-23T15:07:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd54] <DEBUG>: Exit code: 2


* From automation run. Trust add without enforcing range-type to AD using posix attributes

[2014-01-23T15:31:59Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51] <DEBUG>: RUN ['ipa', 'trust-add', '--type', 'ad', 'adposix.qe', '--admin', 'Administrator', '--password']
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>: ---------------------------------------------------
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>: Added Active Directory trust for realm "adposix.qe"
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>: ---------------------------------------------------
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   Realm name: adposix.qe
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   Domain NetBIOS name: ADPOSIX
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   Domain Security Identifier: S-1-5-21-3655340000-3880942204-3419777279
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   SID blacklist incoming: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16, S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   SID blacklist outgoing: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16, S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   Trust direction: Two-way trust
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   Trust type: Active Directory domain
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   Trust status: Established and verified
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51] <DEBUG>: Exit code: 0

.[2014-01-23T15:32:33Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.OpenSSHTransport] <INFO>: RUN ['ipa', 'idrange-show', 'ADPOSIX.QE_id_range', '--all', '--raw']
[2014-01-23T15:32:33Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59] <DEBUG>: RUN ['ipa', 'idrange-show', 'ADPOSIX.QE_id_range', '--all', '--raw']
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   dn: cn=ADPOSIX.QE_id_range,cn=ranges,cn=etc,dc=testrelm,dc=com
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   cn: ADPOSIX.QE_id_range
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   ipaBaseID: 10000
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   ipaBaseRID: 0
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   ipaIDRangeSize: 200000
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   ipaNTTrustedDomainSID: S-1-5-21-3655340000-3880942204-3419777279
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   ipaRangeType: ipa-ad-trust-posix
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   objectClass: ipaIDrange
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   objectClass: ipatrustedaddomainrange
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59] <DEBUG>: Exit code: 0
.[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.OpenSSHTransport] <INFO>: RUN ['getent', 'passwd', 'testuser']
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd60] <DEBUG>: RUN ['getent', 'passwd', 'testuser']
[2014-01-23T15:32:39Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd60.out] <DEBUG>: testuser:*:10042:10047:Test User:/home/testuser:/bin/sh
[2014-01-23T15:32:39Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd60] <DEBUG>: Exit code: 0
.[2014-01-23T15:32:39Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.OpenSSHTransport] <INFO>: RUN ['getent', 'passwd', 'nonposixuser']
[2014-01-23T15:32:39Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd61] <DEBUG>: RUN ['getent', 'passwd', 'nonposixuser']
[2014-01-23T15:32:40Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd61] <DEBUG>: Exit code: 2

Comment 5 Alexander Bokovoy 2014-05-20 10:36:48 UTC

Clarify doc text.

Comment 6 Ludek Smid 2014-06-13 10:34:10 UTC

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.