Bug 1213947
| Summary: | Group resolution is inconsistent with group overrides | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Steeve Goveas <sgoveas> | ||||
| Component: | sssd | Assignee: | Sumit Bose <sbose> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> | ||||
| Severity: | unspecified | Docs Contact: | Tomas Capek <tcapek> | ||||
| Priority: | medium | ||||||
| Version: | 6.7 | CC: | atolani, cww, drieden, grajaiya, jgalipea, jhrozek, lslebodn, mkosek, mzidek, nsoman, pbrezina, preichl, sbose, sumenon | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | sssd-1.12.4-38.el6 | Doc Type: | Known Issue | ||||
| Doc Text: |
Group resolution is inconsistent with group overrides
If a group GID is overriden, running the "id" command reports an incorrect GID. To work around this problem, run the "getent group" command on the overriden group.
|
Story Points: | --- | ||||
| Clone Of: | |||||||
| : | 1214719 (view as bug list) | Environment: | |||||
| Last Closed: | 2016-05-10 20:22:29 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1172231, 1214719, 1272422 | ||||||
| Attachments: |
|
||||||
Upstream ticket: https://fedorahosted.org/sssd/ticket/2633 Fixed upstream:
master:
2263c6dd1242c92253240f4998c86a04b6a0ca3a
145578006684481434ced78461ab8d1c3570f478
cffe3135f29c737f2598f3c1384bfba1694fb843
e87badc0f6fb20a443cf12bde9582ecbc2aef727
sssd-1-12:
eaf656843831d579f30f94154d88aba2201c1712
58a19d50888b1a7da0ee78b49e7d3dcbebc8614d
f643fadbd072a9d3725f5f750340d5b13628ce6a
24905d4ecbf210687e385449448f5a5ec97d2833
Created attachment 1127898 [details]
Console output
Verified using ipa-client-3.0.0-50.el6.x86_64 on RHEL6.8 IPA-Client with RHEL 7.2 IPA (ipa-server-4.2.0-15.el7_2.3.x86_64) trust with Windows2K12 R2 AD. id command was not displaying output on the client because there was no existing group in the trusted AD having the GID set in the POSIX Attribute similar to that of the overridden value specified while modifying the trusted user in 'Default Trust View' After adding the groups the id output is displayed correctly on the IPA-client. [root@r683 ~]# id idviewuser1 uid=10000(syncuser07) gid=10001(agroup1) groups=10001(agroup1),10000(domain users) [root@r683 ~]# id idviewuser2 uid=1902400018(idviewuser2) gid=1902400018(test2) groups=1902400018(test2),10000(domain users) [root@r683 ~]# id idviewuser3 uid=1902400017(idviewuser3) gid=1902400017(test3) groups=1902400017(test3),10000(domain users) [root@r683 ~]# id test1.qe uid=999999991(test1.qe) gid=999999991(test4) groups=999999991(test4),10000(domain users) Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-0782.html |
Description of problem: If id user is run first, then all groups are resolved without the group override for the user's group. Running getent for the group on an empty cache applies the override but id for the user does not resolve all group memberships. Version-Release number of selected component (if applicable): [root@ibm-x3250m4-04 ~]# rpm -q sssd ipa-client sssd-1.12.4-29.el6.x86_64 ipa-client-3.0.0-46.el6.x86_64 How reproducible: always Steps to Reproduce: On Server * No other view applied on any client host [root@sideswipe ~]# ipa idoverridegroup-find 'default trust view' ---------------------------- 2 Group ID overrides matched ---------------------------- Anchor to override: adgroup1 GID: 12121212 Anchor to override: adgroup1.qe GID: 78787878 ---------------------------- Number of entries returned 2 ---------------------------- [root@sideswipe ~]# ipa idoverrideuser-find 'default trust view' --------------------------- 4 User ID overrides matched --------------------------- Anchor to override: aduser07 User login: syncuser07 Anchor to override: aduser1 UID: 1902400018 GID: 1902400018 Home directory: /home/aduser1 Anchor to override: aduser1.qe UID: 999999991 GID: 999999991 Home directory: /home/pune/aduser1 Login shell: /bin/tcsh Anchor to override: aduser2 UID: 1902400017 GID: 1902400017 Home directory: /home/aduser2 ---------------------------- Number of entries returned 4 ---------------------------- [root@sideswipe ~]# service sssd stop ; rm -f /var/lib/sss/{db,mc}/* ; service sssd start Redirecting to /bin/systemctl stop sssd.service Redirecting to /bin/systemctl start sssd.service On Client1 [root@ibm-x3250m4-04 ~]# service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start Stopping sssd: [ OK ] Starting sssd: [ OK ] [root@ibm-x3250m4-04 ~]# id aduser1.qe uid=999999991(aduser1.qe) gid=999999991(aduser1.qe) groups=999999991(aduser1.qe),1148402424(adunigroup1),839001172(adgroup2.qe),839001120(adgroup1.qe),839000513(domain users.qe) [root@ibm-x3250m4-04 ~]# getent group adgroup1.qe adgroup1.qe:*:839001120:aduser1.qe,aduser2.qe [root@ibm-x3250m4-04 ~]# getent group adgroup1 adgroup1:*:12121212:aduser2,aduser1 * Clear sssd cache on server and client [root@ibm-x3250m4-04 ~]# service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start Stopping sssd: [ OK ] Starting sssd: [ OK ] [root@ibm-x3250m4-04 ~]# getent group adgroup1.qe adgroup1.qe:*:78787878:aduser1.qe,aduser2.qe [root@ibm-x3250m4-04 ~]# id aduser1.qe uid=999999991(aduser1.qe) gid=999999991(aduser1.qe) groups=999999991(aduser1.qe),78787878(adgroup1.qe) [root@ibm-x3250m4-04 ~]# getent group adgroup1 adgroup1:*:12121212:aduser2,aduser1