Bug 1002651 - [RFE] It should be possible to use uid/gid defined in AD instead of SIDs
Summary: [RFE] It should be possible to use uid/gid defined in AD instead of SIDs
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.0
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: Martin Kosek
QA Contact: Namita Soman
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-08-29 16:31 UTC by Dmitri Pal
Modified: 2014-06-18 00:11 UTC (History)
4 users (show)

Fixed In Version: ipa-3.3.1-1.el7
Doc Type: Release Note
Doc Text:
Cross-realm trusts support in IdM allows to get POSIX user or group ID attributes from Active Directory IdM implementation of cross-realm trusts to Active Directory supports existing POSIX user and group ID attributes in AD. When explicit mappings are not defined at Active Directory side, algorithmic mapping based on user or group Security Identitifier (SID) is applied.
Clone Of:
Environment:
Last Closed: 2014-06-13 10:34:10 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Dmitri Pal 2013-08-29 16:31:05 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/2904

The first implementation of the trusts solution takes SID of the user entry and uses a special algorithm to create unique UID for the user. The similar approach is used for GID. This works fine for the deployments that do not have POSIX attributes defined in AD. In the cases when POSIX attributes are defined in AD there are usually already clients that leverage these attributes so switching to the SID->UIS/GID model is not acceptable. Instead IPA and SSSD should be able to respect the POSIX attributes defined in the AD.

SSSD ticket https://fedorahosted.org/sssd/ticket/1408
Comment 1 Tomas Babej 2013-08-30 13:47:59 UTC 
For detailed reference, please see:

https://fedorahosted.org/freeipa/ticket/2904#comment:17
Comment 2 Rob Crittenden 2013-08-30 13:57:49 UTC 
master:

d2b943f08b6fd49b7adccbf6fa84e7d63d8f08b1
1c0f0517f521cd36e407f6038e6eefdaf3441b3
ddb39570115b6b6cca71d66e9bf1a8463f599514
e4437a3e7ffcb547a00a70614804dc35fefd630e
84b2269589c115cae2d2bcec32fec602143fc42e
17c7d46c254de8301a1c328155d245631d5c03e4
Comment 4 Steeve Goveas 2014-01-29 07:45:10 UTC 
Verified in version
ipa-server-3.3.3-13.el7.x86_64

* From automation run with range type ipa-ad-trust-posix

[2014-01-23T15:06:45Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.OpenSSHTransport] <INFO>: RUN ['ipa', 'trust-add', '--type', 'ad', 'adposix.qe', '--admin', 'Administrator', '--password', '--range-type', 'ipa-ad-trust-posix']
[2014-01-23T15:06:45Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44] <DEBUG>: RUN ['ipa', 'trust-add', '--type', 'ad', 'adposix.qe', '--admin', 'Administrator', '--password', '--range-type', 'ipa-ad-trust-posix']
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>: ---------------------------------------------------
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>: Added Active Directory trust for realm "adposix.qe"
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>: ---------------------------------------------------
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   Realm name: adposix.qe
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   Domain NetBIOS name: ADPOSIX
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   Domain Security Identifier: S-1-5-21-3655340000-3880942204-3419777279
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   SID blacklist incoming: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16, S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   SID blacklist outgoing: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16, S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   Trust direction: Two-way trust
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   Trust type: Active Directory domain
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44.out] <DEBUG>:   Trust status: Established and verified
[2014-01-23T15:07:10Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd44] <DEBUG>: Exit code: 0

.[2014-01-23T15:07:27Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.OpenSSHTransport] <INFO>: RUN ['ipa', 'idrange-show', 'ADPOSIX.QE_id_range', '--all', '--raw']
[2014-01-23T15:07:27Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52] <DEBUG>: RUN ['ipa', 'idrange-show', 'ADPOSIX.QE_id_range', '--all', '--raw']
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   dn: cn=ADPOSIX.QE_id_range,cn=ranges,cn=etc,dc=testrelm,dc=com
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   cn: ADPOSIX.QE_id_range
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   ipaBaseID: 10000
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   ipaBaseRID: 0
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   ipaIDRangeSize: 200000
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   ipaNTTrustedDomainSID: S-1-5-21-3655340000-3880942204-3419777279
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   ipaRangeType: ipa-ad-trust-posix
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   objectClass: ipaIDrange
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52.out] <DEBUG>:   objectClass: ipatrustedaddomainrange
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd52] <DEBUG>: Exit code: 0
.[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.OpenSSHTransport] <INFO>: RUN ['getent', 'passwd', 'testuser']
[2014-01-23T15:07:28Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd53] <DEBUG>: RUN ['getent', 'passwd', 'testuser']
[2014-01-23T15:07:33Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd53.out] <DEBUG>: testuser:*:10042:10047:Test User:/home/testuser:/bin/sh
[2014-01-23T15:07:33Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd53] <DEBUG>: Exit code: 0
.[2014-01-23T15:07:33Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.OpenSSHTransport] <INFO>: RUN ['getent', 'passwd', 'nonposixuser']
[2014-01-23T15:07:33Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd54] <DEBUG>: RUN ['getent', 'passwd', 'nonposixuser']
[2014-01-23T15:07:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd54] <DEBUG>: Exit code: 2


* From automation run. Trust add without enforcing range-type to AD using posix attributes

[2014-01-23T15:31:59Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51] <DEBUG>: RUN ['ipa', 'trust-add', '--type', 'ad', 'adposix.qe', '--admin', 'Administrator', '--password']
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>: ---------------------------------------------------
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>: Added Active Directory trust for realm "adposix.qe"
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>: ---------------------------------------------------
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   Realm name: adposix.qe
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   Domain NetBIOS name: ADPOSIX
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   Domain Security Identifier: S-1-5-21-3655340000-3880942204-3419777279
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   SID blacklist incoming: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16, S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   SID blacklist outgoing: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16, S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   Trust direction: Two-way trust
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   Trust type: Active Directory domain
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51.out] <DEBUG>:   Trust status: Established and verified
[2014-01-23T15:32:17Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd51] <DEBUG>: Exit code: 0

.[2014-01-23T15:32:33Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.OpenSSHTransport] <INFO>: RUN ['ipa', 'idrange-show', 'ADPOSIX.QE_id_range', '--all', '--raw']
[2014-01-23T15:32:33Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59] <DEBUG>: RUN ['ipa', 'idrange-show', 'ADPOSIX.QE_id_range', '--all', '--raw']
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   dn: cn=ADPOSIX.QE_id_range,cn=ranges,cn=etc,dc=testrelm,dc=com
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   cn: ADPOSIX.QE_id_range
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   ipaBaseID: 10000
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   ipaBaseRID: 0
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   ipaIDRangeSize: 200000
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   ipaNTTrustedDomainSID: S-1-5-21-3655340000-3880942204-3419777279
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   ipaRangeType: ipa-ad-trust-posix
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   objectClass: ipaIDrange
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59.out] <DEBUG>:   objectClass: ipatrustedaddomainrange
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd59] <DEBUG>: Exit code: 0
.[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.OpenSSHTransport] <INFO>: RUN ['getent', 'passwd', 'testuser']
[2014-01-23T15:32:34Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd60] <DEBUG>: RUN ['getent', 'passwd', 'testuser']
[2014-01-23T15:32:39Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd60.out] <DEBUG>: testuser:*:10042:10047:Test User:/home/testuser:/bin/sh
[2014-01-23T15:32:39Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd60] <DEBUG>: Exit code: 0
.[2014-01-23T15:32:39Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.OpenSSHTransport] <INFO>: RUN ['getent', 'passwd', 'nonposixuser']
[2014-01-23T15:32:39Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd61] <DEBUG>: RUN ['getent', 'passwd', 'nonposixuser']
[2014-01-23T15:32:40Z ipa.ipatests.test_integration.host.Host.hp-bl490cg6-01.cmd61] <DEBUG>: Exit code: 2
Comment 5 Alexander Bokovoy 2014-05-20 10:36:48 UTC 
Clarify doc text.
Comment 6 Ludek Smid 2014-06-13 10:34:10 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.
Note You need to log in before you can comment on or make changes to this bug.