Bug 1998459

Summary:	2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
Product:	Red Hat Enterprise Linux 9	Reporter:	Alexey Tikhonov <atikhono>
Component:	sssd	Assignee:	Sumit Bose <sbose>
Status:	CLOSED ERRATA	QA Contact:	Dan Lavu <dlavu>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	9.0	CC:	dlavu, grajaiya, jhrozek, lslebodn, mzidek, pbrezina, sgoveas, tscherf
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	sync-to-jira
Fixed In Version:	sssd-2.6.1-1.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-17 16:00:30 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Alexey Tikhonov 2021-08-27 09:46:00 UTC

This bug was initially created as a copy of Bug #1984591

I am copying this bug because: to track fix for RHEL9



Description of problem:
 - After sssd update to 1.16.5-10.el7_9.8.x86_64 the customer is facing slow connection/authentication.

BEFORE UPGRADE:
[root@HOST01 ~]# date; time id sssd
Tue Jun 29 13:41:22 EDT 2021
uid=217(sssd) gid=987(sssd) groups=987(sssd)
  real    1m30.030s
  user    0m0.004s
  sys     0m0.004s

AFTER DOWNGRADE
[root@HOST01 ~]# date; time id sssd
Tue Jun 29 13:47:17 EDT 2021
uid=217(sssd) gid=987(sssd) groups=987(sssd)
 real    0m7.300s
 user    0m0.003s
 sys     0m0.004s
=======================================================================
Version-Release number of selected component (if applicable):
BEFORE:
  1.16.5-10.el7_9.7.x86_64

AFTER UPGRADE:
  1.16.5-10.el7_9.8.x86_64 
=======================================================================

How reproducible:
 Upgrading sssd

Steps to Reproduce:
  1. Upgrading sssd 
  2. Authentication and fetch users/groups are slowing.
  3. Restarting sssd and clear cache does NOT help.
======================================================================
Actual results:
  Slow authentication and fetch users.

Expected results:
  Normal behaviour as using previous version:
=====================================================================

Additional info:
A - We figure out a workaround adding the parameter "ad_enabled_domains " on sssd.conf, however the customer said that it worked for more than 3 years without add the below line: 
   ad_enabled_domains = domain1.com, domain2.example.com, domain3.example.com, domain4.example.com.

B- After add "ad_enabled_domains", the sssd is working properly again with the new sssd release.

C- We also noticed the below difference after the update:
[root@zzzkctst011 ~]# sssctl domain-list
  domain1.com
  domain2.example.com
  domain3.example.com
  domain4.example.com.
[root@HOST01 ~]# rpm -q sssd
  sssd-1.16.5-10.el7_9.7.x86_64
  **NOTE: JUST 4 DOMAINS ARE FETCHED.

But after updating it to version 1.16.5-10.0.1.el7_9.8 we are seeing this domains.

[root@HOST01 ~]# sssctl domain-list
  domain1.com
  domain2.example.com
  domain3.example.com
  domain4.example.com.
  DOMAIN.NET
  DOMAIN.DMZ
  DOMAIN5.COM
  DOMAIN.LOCAL
  **NOTE: MANY MORE DOMAINS ARE FETCHED SOME OF THEM INATIVES.

[root@HOST01 ~]# rpm -q sssd
  sssd-1.16.5-10.el7_9.8.x86_64

D- I suspect the fixed #4980 is affecting this part:
   https://sssd.io/release-notes/sssd-1.16.5.html

Comment 1 Alexey Tikhonov 2021-08-27 09:50:37 UTC

https://github.com/SSSD/sssd/commit/95adf488f94f5968f6cfba9e3bef74c07c02ccff causes more domains to appear and in the given case it causes some direct trusts to domains from different forests to show up as well.
It makes sense to filter those (not trusted and from a different forest) domains.

Comments in bz 1984591 may provide additional info.

Comment 2 Alexey Tikhonov 2021-10-29 10:08:52 UTC

Upstream PR: https://github.com/SSSD/sssd/pull/5850

Comment 3 Alexey Tikhonov 2021-11-02 12:13:25 UTC

Pushed PR: https://github.com/SSSD/sssd/pull/5850

* `master`
    * 4c48c4a7792961cf8a228c76975ac370d32904e1 - ad: filter trusted domains
* `sssd-1-16`
    * 87aaf96ab7bd39698c41625d56602ca3de943b87 - ad: filter trusted domains

Comment 14 errata-xmlrpc 2022-05-17 16:00:30 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: sssd), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:4015