Bug 1242942
| Summary: | well-known SID check is broken for NetBIOS prefixes | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Jakub Hrozek <jhrozek> |
| Component: | sssd | Assignee: | Sumit Bose <sbose> |
| Status: | CLOSED ERRATA | QA Contact: | Kaushik Banerjee <kbanerje> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.0 | CC: | grajaiya, jgalipea, jhrozek, lslebodn, mkosek, mzidek, nsoman, pbrezina, preichl, sbose, sumenon |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | sssd-1.13.0-5.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-11-19 11:39:22 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Jakub Hrozek
2015-07-14 13:04:43 UTC
* master: 4f1897ad419790834573643e88ac03e6c5c1c4be Jakub, Can you confirm if this is what is expected here with the fix? Here are the observations on RHEL7.2 1. SID are returned for trusted AD groups >>> import pysss_nss_idmap >>> pysss_nss_idmap.getsidbyname('TEST\\Domain Admins') {'TEST\\Domain Admins': {'type': 2, 'sid': u'S-1-5-21-742749997-2996825573-4184801258-512'}} >>> pysss_nss_idmap.getsidbyname('TEST\Domain Admins') {'TEST\\Domain Admins': {'type': 2, 'sid': u'S-1-5-21-742749997-2996825573-4184801258-512'}} >>> pysss_nss_idmap.getsidbyname("TEST\Domain Admins") {'TEST\\Domain Admins': {'type': 2, 'sid': u'S-1-5-21-742749997-2996825573-4184801258-512'}} >>> pysss_nss_idmap.getsidbyname("TEST\\Domain Admins") {'TEST\\Domain Admins': {'type': 2, 'sid': u'S-1-5-21-742749997-2996825573-4184801258-512'}} 2. SID are returned for trusted AD users. >>> import pysss_nss_idmap >>> pysss_nss_idmap.getsidbyname('TEST\\user1') {'TEST\\user1': {'type': 3, 'sid': u'S-1-5-21-742749997-2996825573-4184801258-1118'}} >>> pysss_nss_idmap.getsidbyname("TEST\\user1") {'TEST\\user1': {'type': 3, 'sid': u'S-1-5-21-742749997-2996825573-4184801258-1118'}} >>> pysss_nss_idmap.getsidbyname("TEST\user1") {'TEST\\user1': {'type': 3, 'sid': u'S-1-5-21-742749997-2996825573-4184801258-1118'}} >>> pysss_nss_idmap.getsidbyname('TEST\user1') {'TEST\\user1': {'type': 3, 'sid': u'S-1-5-21-742749997-2996825573-4184801258-1118'}} Redirecting needinfo to bug owner, but the reproducer looks OK to me. I would just test more different groups and also make sure the FQDN format works as well. Yes, the reproducers are ok. If you do not have it in other test you might want to add lookups with 'Domain Admins' as well. Those are not related to the reported issue but would make the test complete in the sense that all allowed variants of a fully-qualified name are tested. btw why is the bug marked as FailedQA?? Sumit, I have the below user/group in trust AD for which the SID is not returned. >>> pysss_nss_idmap.getsidbyname('TEST\\user10') {} >>> pysss_nss_idmap.getsidbyname('TEST\\user101') {} >>> pysss_nss_idmap.getsidbyname("TEST\\test-group1") {} >>> pysss_nss_idmap.getsidbyname('TEST\\Domain Admins') {} Verified On: RHEL7.2 sssd-1.13.0-26.el7.x86_64 ipa-server-4.2.0-9.el7.x86_64 Obseravtions: resolv.conf entries were incorrect after the system went on a reboot in the testing enviornment as a result of which the lookup failed. Correcting them fixed the issue and returned the SID for groups and users. >>> pysss_nss_idmap.getsidbyname('TEST\\user10') {'TEST\\user10': {'type': 3, 'sid': u'S-1-5-21-742749997-2996825573-4184801258-1130'}} >>> pysss_nss_idmap.getsidbyname('TEST\\user101') {'TEST\\user101': {'type': 3, 'sid': u'S-1-5-21-742749997-2996825573-4184801258-1137'}} >>> pysss_nss_idmap.getsidbyname('TEST\\Domain Controllers') {'TEST\\Domain Controllers': {'type': 2, 'sid': u'S-1-5-21-742749997-2996825573-4184801258-516'}} >>> pysss_nss_idmap.getsidbyname('TEST\\DNSAdmins') {'TEST\\DNSAdmins': {'type': 2, 'sid': u'S-1-5-21-742749997-2996825573-4184801258-1101'}} >>> pysss_nss_idmap.getsidbyname('TEST\\Domain Admins') {'TEST\\Domain Admins': {'type': 2, 'sid': u'S-1-5-21-742749997-2996825573-4184801258-512'}} >>> pysss_nss_idmap.getsidbyname('Domain Admins') {'Domain Admins': {'type': 2, 'sid': u'S-1-5-21-742749997-2996825573-4184801258-512'}} Thanks for testing, can you also remove the failedQA keyword? IIRC this bug never failed testing.. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-2355.html |