Bug 1098608
| Summary: | Expanding home directory fails when the request comes from the PAC responder | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Jan Kurik <jkurik> |
| Component: | sssd | Assignee: | Jakub Hrozek <jhrozek> |
| Status: | CLOSED ERRATA | QA Contact: | Kaushik Banerjee <kbanerje> |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 7.0 | CC: | abokovoy, dpal, grajaiya, jamsmith, jgalipea, jhrozek, jkurik, lslebodn, mkosek, nsoman, pbrezina, pm-eus, preichl, sgoveas, svenkatr |
| Target Milestone: | rc | Keywords: | ZStream |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | sssd-1.11.2-68.el7.1 | Doc Type: | Bug Fix |
| Doc Text: |
This update fixes a SID-to-name mapping issue to allow GSSAPI logins from Windows clients and group memberships to work correctly.
Prior to this update, the code that handles saving user when handling requests on the IPA server failed when the request was a SID-to-name mapping. As a result, users logging in from Windows clients using GSSAPI had their membership set incorrectly because their groups could not be converted from SIDs.
In this update, the code has been fixed to handle SID-to-name conversions.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-06-10 13:08:13 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1097286 | ||
| Bug Blocks: | |||
|
Description
Jan Kurik
2014-05-16 16:16:17 UTC
Verified
* On IPA server having trust with AD win2k12
[root@intel-sugarbay-do-01 ~]# rpm -q sssd ipa-server
sssd-1.11.2-68.el7.1.x86_64
ipa-server-3.3.3-28.el7.x86_64
[root@intel-sugarbay-do-01 ~]# grep server_mode /etc/sssd/sssd.conf
ipa_server_mode = True
[root@intel-sugarbay-do-01 ~]# hostname
intel-sugarbay-do-01.steeve06051959.test
[root@intel-sugarbay-do-01 ~]# service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start
Redirecting to /bin/systemctl stop sssd.service
Redirecting to /bin/systemctl start sssd.service
* Login to client with GSSAPI auth
[root@intel-sugarbay-do-01 ~]# kdestroy -A
[root@intel-sugarbay-do-01 ~]# echo Secret123 | kinit aduser1
Password for aduser1:
[root@intel-sugarbay-do-01 ~]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: aduser1
Valid starting Expires Service principal
06/06/2014 04:01:50 06/06/2014 14:01:50 krbtgt/ADTEST.QE
renew until 06/07/2014 04:01:49
[root@intel-sugarbay-do-01 ~]# ssh -K -l aduser1 tyan-gt24-13.steeve06051959.test
-sh-4.2$ id
uid=1148401313(aduser1) gid=1148401313(aduser1) groups=1148401313(aduser1),1148400513(domain users),1148401449(adgroup1),1148402424(adunigroup1),1148402425(adgroup2) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
-sh-4.2$ hostname
tyan-gt24-13.steeve06051959.test
-sh-4.2$ logout
Connection to tyan-gt24-13.steeve06051959.test closed.
* Login to IPA server from client
[root@tyan-gt24-13 ~]# rpm -q sssd ipa-server
sssd-1.11.2-68.el7.1.x86_64
ipa-server-3.3.3-28.el7.x86_64
[root@tyan-gt24-13 ~]# hostname
tyan-gt24-13.steeve06051959.test
[root@tyan-gt24-13 ~]# kdestroy -A ; klist
klist: No credentials cache found (ticket cache KEYRING:persistent:0:0)
[root@tyan-gt24-13 ~]# service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start
Redirecting to /bin/systemctl stop sssd.service
Redirecting to /bin/systemctl start sssd.service
[root@tyan-gt24-13 ~]# echo Secret123 | kinit aduser1.QE
Password for aduser1.QE:
[root@tyan-gt24-13 ~]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: aduser1.QE
Valid starting Expires Service principal
06/06/2014 04:04:45 06/06/2014 14:04:45 krbtgt/PUNE.ADTEST.QE.QE
renew until 06/07/2014 04:04:44
[root@tyan-gt24-13 ~]# ssh -K -l aduser1.qe intel-sugarbay-do-01.steeve06051959.test
-sh-4.2$ klist
Ticket cache: KEYRING:persistent:839001130:839001130
Default principal: aduser1.QE
Valid starting Expires Service principal
06/06/2014 04:05:11 06/06/2014 14:04:45 krbtgt/PUNE.ADTEST.QE.QE
renew until 06/07/2014 04:04:44
-sh-4.2$ id
uid=839001130(aduser1.qe) gid=839001130(aduser1.qe) groups=839001130(aduser1.qe),839000513(domain users.qe),839001120(adgroup1.qe),839001172(adgroup2.qe),1148402424(adunigroup1) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
-sh-4.2$ logout
Connection to intel-sugarbay-do-01.steeve06051959.test closed.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2014-0715.html |