Bug 692090

We need some more information to understand what's going on here. SSSD *should* be handling this correctly already.

Can you please include in the ticket the (sanitized) LDAP contents for domainlocalgroup, domainglobal and linuxuser1?

I want to see what attributes are set there, most notably the 'member', 'memberOf', 'memberuid' and gidNumber attributes for the groups, as well as the 'uid', 'uidNumber', 'gidNumber' and 'memberOf' attributes for the users.

Also, a listing of the objectClasses in use for both types would be very helpful.

Oh, and we'd also like for you to turn on debugging and send us the debug logs. You can do this by setting 'debug_level = 9' in the [domain/AD] section of sssd.conf and restarting the SSSD ('service sssd restart' as root).

Then attempt your request as described in this ticket, note the time that you perform this request and then attach /var/log/sssd/sssd_AD.log to this Bugzilla ticket. (If you have company-sensitive information such as the domain name, please feel free to sanitize it).

This debug log will give us a lot of information to follow the code path and to see where errors may be ocurring.

Created attachment 488765 [details]
AD group memberships and configuration

this is what I get with old configuration:
[root@localhost ~]# id linuxuser1
uid=10000(linuxuser1) gid=10001(Linux_Users) groups=10001(Linux_Users),10045(domainlocalgroup)

domainglobal is not Unix Group 

[root@localhost ~]# getent group domainlocalgroup
domainlocalgroup:*:10045:linuxuser1,linuxuser2


and this is what I get with sssd:

[root@localhost ~]# id linuxuser1
uid=10000(linuxuser1) gid=10001(Linux_Users) groups=10001(Linux_Users)

domainglobal is not Unix Group 

[root@localhost ~]# getent group domainlocalgroup
domainlocalgroup:*:10045:


about attached images:

1.jpg = domainlocalgroup memberof 
2.jpg = domainlocalgroup unix attributes
3.jpg = domainglobal members 
4.jpg = domainglobal unix attributes 
5.jpg = domainglobal membersof 
6.jpg = linuxuser1 unix attributes

will attach logs soon

(In reply to comment #3)
> Created attachment 488765 [details]
> AD group memberships and configuration

Those screenshots aren't terribly useful. I need to see the actual LDAP contents.

This can be found by doing (from Linux):

ldapsearch -x -H ldap://ldap.example.com -b dc=example,dc=com \
-D CN=List,OU=General,OU=Users,DC=example,DC=com -W \
"(uid=linuxuser1)"

Substitute "(cn=domainlocalgroup)" in the last part to get the attributes for the groups.

Ok, I think I understand the hierarchy here now. Sorry for the confusion.

So you have two users which have UNIX attributes, linuxuser1 and linuxuser2. These users are members of a group called domainglobal, which is NOT configured for use with UNIX.

The group domainglobal is a nested member of the group domainlocalgroup which DOES have UNIX configuration.

So the bug as you see it is that lookups for domainlocalgroup should return linuxuser1 and linuxuser2 as members. And in reverse, a lookup of the groups for linuxuser1 and linuxuser2 should list domainlocalgroup.

Ok, so this is a known limitation of the SSSD at this time.

The problem is that the way we do caching right now requires that all entries in the nesting chain must have complete UNIX attributes. Otherwise our caching routines throw an error (this is to guarantee that all lookups maintain their integrity).

I've opened a ticket upstream (https://fedorahosted.org/sssd/ticket/833) to track this request. It will be a significant effort, and so I'm moving the proposed inclusion out to RHEL 6.2.

Thanks for update. You are right about the configuration I have. 

Do you have any knowledge about when 6.1 and 6.2 are planned to be released ?

I can't make any specific statements about release schedules. I will, however, note that 6.1 beta was released five days ago, so that should give you a decent indication as to when 6.1 is due.

Verified in version:

# rpm -qi sssd | head
Name        : sssd                         Relocations: (not relocatable)
Version     : 1.5.1                             Vendor: Red Hat, Inc.
Release     : 52.el6                        Build Date: Tue 20 Sep 2011 09:11:03 PM IST
Install Date: Mon 26 Sep 2011 05:56:30 PM IST      Build Host: x86-010.build.bos.redhat.com
Group       : Applications/System           Source RPM: sssd-1.5.1-52.el6.src.rpm
Size        : 3550647                          License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://fedorahosted.org/sssd/
Summary     : System Security Services Daemon

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: SSSD required that all groups it worked with had a complete set of UNIX attributes. However, Active Directory groups can be individually set with or without UNIX attributes. When a group without UNIX attributes had a member that did have UNIX attributes, SSSD would not have recursed to the nested UNIX group
Consequence: SSSD was unable to traverse the hierarchy correctly and the initgroups() operation did not return all groups correctly
Fix: SSSD was changed so it can examine non-UNIX groups for potential UNIX nested member groups
Result: SSSD is able to traverse the hierarchy correctly and return the complete list of groups even if the hierarchy mixes UNIX and non-UNIX groups

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1529.html