Bug 1758566
| Summary: | negative cache does not use values from 'filter_users' config option for known domains [rhel-7.7.z] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | RAD team bot copy to z-stream <autobot-eus-copy> |
| Component: | sssd | Assignee: | Michal Zidek <mzidek> |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.7 | CC: | amore, grajaiya, jhrozek, ksiddiqu, lslebodn, mzidek, ndehadra, pbrezina, peter.vreman, sbose, sgoveas, tscherf, vmishra |
| Target Milestone: | rc | Keywords: | ZStream |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | sssd-1.16.4-21.el7_7.1 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1724088 | Environment: | |
| Last Closed: | 2019-11-26 13:57:38 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1724088 | ||
| Bug Blocks: | |||
|
Description
RAD team bot copy to z-stream
2019-10-04 14:15:57 UTC
[root@master ~]# rpm -qa sssd
sssd-1.16.4-21.el7_7.1.x86_64
[root@master ~]# grep -B 3 "filter_users" /etc/sssd/sssd.conf
[nss]
memcache_timeout = 600
homedir_substring = /home
filter_users = aduser1
[root@master ~]# ipa config-show | grep resolution
Domain resolution order: ipaad2k16cin.test:sssd77.test
[root@master ~]# ipactl stop
Stopping ipa-dnskeysyncd Service
Stopping ipa-otpd Service
Stopping pki-tomcatd Service
Stopping ntpd Service
Stopping ipa-custodia Service
Stopping httpd Service
Stopping named Service
Stopping kadmin Service
Stopping krb5kdc Service
Stopping Directory Service
ipa: INFO: The ipactl command was successful
[root@master ~]# service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start
Redirecting to /bin/systemctl stop sssd.service
Redirecting to /bin/systemctl start sssd.service
[root@master ~]# ipactl start
Starting Directory Service
Starting krb5kdc Service
Starting kadmin Service
Starting named Service
Starting httpd Service
Starting ipa-custodia Service
Starting ntpd Service
Starting pki-tomcatd Service
Starting smb Service
Starting winbind Service
Starting ipa-otpd Service
Starting ipa-dnskeysyncd Service
ipa: INFO: The ipactl command was successful
[root@master ~]# sssctl domain-list | grep ipaad2k16cin.test
ipaad2k16cin.test
ipasubad2k16cin.ipaad2k16cin.test
[root@master ~]#
[root@master ~]# id aduser1
id: aduser1: no such user
[root@master ~]# date
Mon Nov 11 04:00:44 EST 2019
[root@master ~]# grep -F "Looking up [aduser1] in data provider" /var/log/sssd/sssd_nss.log
[root@master ~]# echo $?
1
[root@master ~]# grep -F "in data provider" /var/log/sssd/sssd_nss.log
(Mon Nov 11 03:58:12 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #0: Looking up [named] in data provider
(Mon Nov 11 03:58:13 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #1: Looking up [kdcproxy] in data provider
(Mon Nov 11 03:58:13 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #2: Looking up [kdcproxy] in data provider
(Mon Nov 11 03:58:13 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #3: Looking up [ipaapi] in data provider
(Mon Nov 11 03:58:13 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #4: Looking up [ipaapi] in data provider
(Mon Nov 11 03:58:13 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #5: Looking up [apache] in data provider
(Mon Nov 11 03:58:13 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #6: Looking up [apache] in data provider
(Mon Nov 11 03:58:13 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #7: Looking up [ipaapi] in data provider
(Mon Nov 11 03:58:13 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #8: Looking up [apache] in data provider
(Mon Nov 11 03:58:13 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #9: Looking up [apache] in data provider
(Mon Nov 11 03:58:13 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #10: Looking up [ipaapi] in data provider
(Mon Nov 11 03:58:13 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #11: Looking up [apache] in data provider
(Mon Nov 11 03:58:15 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #12: Looking up [pkiuser] in data provider
(Mon Nov 11 03:58:16 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #13: Looking up [ntp] in data provider
(Mon Nov 11 03:58:18 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #14: Looking up [pkiuser] in data provider
(Mon Nov 11 03:58:24 2019) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #15: Looking up [ods] in data provider
[root@master ~]#
In latest version there is no call log for known doamains like "Looking up [aduser] in data provider" messages in sssd_nss.log
Based on This moving bz to verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:3972 |