Bug 2018432

Summary:	2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
Product:	Red Hat Enterprise Linux 8	Reporter:	Alexey Tikhonov <atikhono>
Component:	sssd	Assignee:	Sumit Bose <sbose>
Status:	CLOSED ERRATA	QA Contact:	Dan Lavu <dlavu>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	8.5	CC:	dlavu, grajaiya, jhrozek, lslebodn, mzidek, pbrezina, sgoveas, tscherf
Target Milestone:	rc	Keywords:	Triaged, ZStream
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	sync-to-jira
Fixed In Version:	sssd-2.6.1-1.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	2018440 (view as bug list)		Environment:
Last Closed:	2022-05-10 15:26:44 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2018440

Description Alexey Tikhonov 2021-10-29 10:14:47 UTC

This bug was initially created as a copy of Bug #1998459

I am copying this bug because: to track fix for RHEL8



This bug was initially created as a copy of Bug #1984591

I am copying this bug because: to track fix for RHEL9



Description of problem:
 - After sssd update to 1.16.5-10.el7_9.8.x86_64 the customer is facing slow connection/authentication.

BEFORE UPGRADE:
[root@HOST01 ~]# date; time id sssd
Tue Jun 29 13:41:22 EDT 2021
uid=217(sssd) gid=987(sssd) groups=987(sssd)
  real    1m30.030s
  user    0m0.004s
  sys     0m0.004s

AFTER DOWNGRADE
[root@HOST01 ~]# date; time id sssd
Tue Jun 29 13:47:17 EDT 2021
uid=217(sssd) gid=987(sssd) groups=987(sssd)
 real    0m7.300s
 user    0m0.003s
 sys     0m0.004s
=======================================================================
Version-Release number of selected component (if applicable):
BEFORE:
  1.16.5-10.el7_9.7.x86_64

AFTER UPGRADE:
  1.16.5-10.el7_9.8.x86_64 
=======================================================================

How reproducible:
 Upgrading sssd

Steps to Reproduce:
  1. Upgrading sssd 
  2. Authentication and fetch users/groups are slowing.
  3. Restarting sssd and clear cache does NOT help.
======================================================================
Actual results:
  Slow authentication and fetch users.

Expected results:
  Normal behaviour as using previous version:
=====================================================================

Additional info:
A - We figure out a workaround adding the parameter "ad_enabled_domains " on sssd.conf, however the customer said that it worked for more than 3 years without add the below line: 
   ad_enabled_domains = domain1.com, domain2.example.com, domain3.example.com, domain4.example.com.

B- After add "ad_enabled_domains", the sssd is working properly again with the new sssd release.

C- We also noticed the below difference after the update:
[root@zzzkctst011 ~]# sssctl domain-list
  domain1.com
  domain2.example.com
  domain3.example.com
  domain4.example.com.
[root@HOST01 ~]# rpm -q sssd
  sssd-1.16.5-10.el7_9.7.x86_64
  **NOTE: JUST 4 DOMAINS ARE FETCHED.

But after updating it to version 1.16.5-10.0.1.el7_9.8 we are seeing this domains.

[root@HOST01 ~]# sssctl domain-list
  domain1.com
  domain2.example.com
  domain3.example.com
  domain4.example.com.
  DOMAIN.NET
  DOMAIN.DMZ
  DOMAIN5.COM
  DOMAIN.LOCAL
  **NOTE: MANY MORE DOMAINS ARE FETCHED SOME OF THEM INATIVES.

[root@HOST01 ~]# rpm -q sssd
  sssd-1.16.5-10.el7_9.8.x86_64

D- I suspect the fixed #4980 is affecting this part:
   https://sssd.io/release-notes/sssd-1.16.5.html

Comment 1 Alexey Tikhonov 2021-10-29 10:31:37 UTC

Upstream PR: https://github.com/SSSD/sssd/pull/5850

Comment 5 Alexey Tikhonov 2021-11-02 12:13:34 UTC

Pushed PR: https://github.com/SSSD/sssd/pull/5850

* `master`
    * 4c48c4a7792961cf8a228c76975ac370d32904e1 - ad: filter trusted domains
* `sssd-1-16`
    * 87aaf96ab7bd39698c41625d56602ca3de943b87 - ad: filter trusted domains

Comment 6 Dan Lavu 2021-12-03 23:56:00 UTC

Verified tested against sssd-2.6.1-1.el8.x86_64

2021-12-03 18:36:26,174 - sssd.testlib.common.qe_class.QeHost.hostname1.ParamikoTransport - INFO - RUN sssctl domain-list
2021-12-03 18:36:26,175 - sssd.testlib.common.qe_class.QeHost.hostname1.cmd82 - DEBUG - RUN sssctl domain-list
2021-12-03 18:36:26,410 - sssd.testlib.common.qe_class.QeHost.hostname1.cmd82 - DEBUG - implicit_files
2021-12-03 18:36:26,410 - sssd.testlib.common.qe_class.QeHost.hostname1.cmd82 - DEBUG - domain.com
2021-12-03 18:36:26,410 - sssd.testlib.common.qe_class.QeHost.hostname1.cmd82 - DEBUG - child.domain.com
2021-12-03 18:36:26,411 - sssd.testlib.common.qe_class.QeHost.hostname1.cmd82 - DEBUG - child1.domain.com
2021-12-03 18:36:26,411 - sssd.testlib.common.qe_class.QeHost.hostname1.cmd82 - DEBUG - tdomain.com
2021-12-03 18:36:26,412 - sssd.testlib.common.qe_class.QeHost.hostname1.cmd82 - DEBUG - Exit code: 0
implicit_files
domain.com
child.domain.com
child1.domain.com
tdomain.com

PASSED

Comment 12 errata-xmlrpc 2022-05-10 15:26:44 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sssd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2070