Bug 1436987

Summary:	ipasam: gidNumber attribute is not created in the trusted domain entry
Product:	Red Hat Enterprise Linux 7	Reporter:	Petr Vobornik <pvoborni>
Component:	ipa	Assignee:	IPA Maintainers <ipa-maint>
Status:	CLOSED ERRATA	QA Contact:	Varun Mylaraiah <mvarun>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.4	CC:	frenaud, ksiddiqu, mbasti, mvarun, pvoborni, rcritten, tscherf
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-4.5.0-6.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-01 09:47:49 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Petr Vobornik 2017-03-29 08:07:01 UTC

Cloned from upstream: https://pagure.io/freeipa/issue/6827

While investigating issue 6660, samba logs were showing:

    [2017/03/28 17:02:35.471728,  0] ../source3/passdb/lookup_sid.c:1605(get_primary_group_sid)
      Failed to find a Unix account for DOM-AD$

This happens in calls to ldapsam_getsampwnam(), which eventually calls get_primary_group_sid() for the trusted domain entry. As the entry does not contain any gidNumber, the call fails.
The gidNumber attribute should be added when the trusted domain entry is created.

Comment 2 Petr Vobornik 2017-03-29 08:07:18 UTC

Upstream ticket:
https://pagure.io/freeipa/issue/6827

Comment 3 Martin Bašti 2017-04-07 10:39:46 UTC

Fixed upstream
master:
https://pagure.io/freeipa/c/e052c2dce04f5ce147dc2b6804f44705fa4d69df
https://pagure.io/freeipa/c/5405de5bc15941d71137af10aa66a6cf922d9e6d
ipa-4-5:
https://pagure.io/freeipa/c/91d36941653476abfff6a54ba7cb5a9f2c12c22d
https://pagure.io/freeipa/c/eddd29f1d52d63ea702437b0dd2a2826df52bc26

Comment 8 Varun Mylaraiah 2017-05-30 17:35:21 UTC

Verified
ipa-server-4.5.0-13.el7.x86_64

Trusted domain entry contain a gidNumber attribute

# ldapsearch -Y GSSAPI -Q -LLL -b "cn=Default SMB Group,cn=groups,cn=accounts,$BASEDN" gidNumber

dn: cn=Default SMB Group,cn=groups,cn=accounts,dc=sudoexsm33,dc=test
gidNumber: 1986800001


# ldapsearch -Y GSSAPI -Q -LLL -b cn=$ADDOMAIN,cn=ad,cn=trusts,$BASEDN -s base gidNumber

dn: cn=pne.qe,cn=ad,cn=trusts,dc=sudoexsm33,dc=test
gidNumber: 1986800001

Comment 9 errata-xmlrpc 2017-08-01 09:47:49 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2304