Bug 1066096

Upstream ticket:
https://fedorahosted.org/sssd/ticket/2251

We agreed that the behaviour in RHEL6 was more correct. Moving to RHEL7 and setting Regression keyword

Fixed upstream:
    master: bb8a08118db0916bf8252a9481c16271ec20acd3
    sssd-1-11: fe2bbd629a72c786d6125066e5bb75005f4cccc7

Jakub would you prefer to treat this BZ as a failed QE or would you rather verify this BZ and open a new BZ for the forest users in this situation?

On each user in AD has the following attributes set. These attributes are not replicated to the global catalog.
    unixHomeDirectory: /home2/{DOMAIN}/posixuser1_dom{1,2,3}
    loginShell: /bin/ksh

test client is joined to the root of the forest.
   [domain/sssdad.com]
    id_provider = ad
    access_provider = ad
    ad_domain = adserver.sssdad.com
    krb5_realm = SSSDAD.COM
    use_fully_qualified_names = True
    ldap_id_mapping = True

the root domain user is correct but child and second tree domain are not using there ldap attributes.
posixuser1_dom1:*:498201554:498200513:posixuser1_dom1:/home2/sssdad.com/posixuser1_dom1:/bin/ksh
posixuser1_dom2:*:525401432:525401432:posixuser1_dom2:/:
posixuser1_dom3.com:*:1184401422:1184401422:posixuser1_dom3:/:

the following settings are added after the first set of checks.
    default_shell = /bin/bash
    fallback_homedir = /home/%d/%u

the root domain user is correct but child and second tree domain are using the default_shell and fallback_homedir compared to there ldap attributes.
posixuser1_dom1:*:498201554:498200513:posixuser1_dom1:/home2/sssdad.com/posixuser1_dom1:/bin/ksh
posixuser1_dom2:*:525401432:525401432:posixuser1_dom2:/home/sssdad_tree.com/posixuser1_dom2:/bin/bash
posixuser1_dom3.com:*:1184401422:1184401422:posixuser1_dom3:/home/child1.sssdad.com/posixuser1_dom3:/bin/bash

automation test created.
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: ad_forest_07: bz 1066096 not retrieving homedirs of AD users with posix attributes
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: checking homedir for posixuser1_dom1 (Assert: /home2/sssdad.com/posixuser1_dom1 should equal /home2/sssdad.com/posixuser1_dom1)
:: [   PASS   ] :: checking shell for posixuser1_dom1 (Assert: /bin/ksh should equal /bin/ksh)
:: [   FAIL   ] :: checking homedir for posixuser1_dom2 (Assert: / should equal /home2/sssdad_tree.com/posixuser1_dom2)
:: [   FAIL   ] :: rlAssertEquals called without all needed parameters 
:: [   FAIL   ] :: checking homedir for posixuser1_dom3.com (Assert: / should equal /home2/child1.sssdad.com/posixuser1_dom3)
:: [   FAIL   ] :: rlAssertEquals called without all needed parameters 
:: [   PASS   ] :: checking homedir with fallback_homedir for posixuser1_dom1 (Assert: /home2/sssdad.com/posixuser1_dom1 should equal /home2/sssdad.com/posixuser1_dom1)
:: [   PASS   ] :: checking shell with default_shell for posixuser1_dom1 (Assert: /bin/ksh should equal /bin/ksh)
:: [   FAIL   ] :: checking homedir with fallback_homedir for posixuser1_dom2 (Assert: /home/sssdad_tree.com/posixuser1_dom2 should equal /home2/sssdad_tree.com/posixuser1_dom2)
:: [   FAIL   ] :: checking shell with default_shell for posixuser1_dom2 (Assert: /bin/bash should equal /bin/ksh)
:: [   FAIL   ] :: checking homedir with fallback_homedir for posixuser1_dom3.com (Assert: /home/child1.sssdad.com/posixuser1_dom3 should equal /home2/child1.sssdad.com/posixuser1_dom3)
:: [   FAIL   ] :: checking shell with default_shell for posixuser1_dom3.com (Assert: /bin/bash should equal /bin/ksh)
:: [   LOG    ] :: Duration: 36s
:: [   LOG    ] :: Assertions: 4 good, 8 bad
:: [   FAIL   ] :: RESULT: ad_forest_07: bz 1066096 not retrieving homedirs of AD users with posix attributes

(In reply to Jeremy Agee from comment #7)
> Jakub would you prefer to treat this BZ as a failed QE or would you rather
> verify this BZ and open a new BZ for the forest users in this situation?
> 
> On each user in AD has the following attributes set. These attributes are
> not replicated to the global catalog.
>     unixHomeDirectory: /home2/{DOMAIN}/posixuser1_dom{1,2,3}
>     loginShell: /bin/ksh

In this case, I think the behaviour is expected. By default, SSSD still connects to GC for subdomain users.

For this use-case, I would suggest to try "ad_enable_gc = False" which should force sssd to connect to the LDAP port of the subdomain DC at the expense of opening multiple connections.

Thanks for the extra info Jakub, the "ad_enable_gc = False" setting was the issue.

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: ad_forest_07: bz 1066096 not retrieving homedirs of AD users with posix attributes
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: checking homedir for posixuser1_dom1 (Assert: /home2/sssdad.com/posixuser1_dom1 should equal /home2/sssdad.com/posixuser1_dom1)
:: [   PASS   ] :: checking shell for posixuser1_dom1 (Assert: /bin/ksh should equal /bin/ksh)
:: [   PASS   ] :: checking homedir for posixuser1_dom2 (Assert: /home2/sssdad_tree.com/posixuser1_dom2 should equal /home2/sssdad_tree.com/posixuser1_dom2)
:: [   PASS   ] :: checking shell for posixuser1_dom2 (Assert: /bin/ksh should equal /bin/ksh)
:: [   PASS   ] :: checking homedir for posixuser1_dom3.com (Assert: /home2/child1.sssdad.com/posixuser1_dom3 should equal /home2/child1.sssdad.com/posixuser1_dom3)
:: [   PASS   ] :: checking shell for posixuser1_dom3.com (Assert: /bin/ksh should equal /bin/ksh)
:: [   PASS   ] :: checking homedir with fallback_homedir for posixuser1_dom1 (Assert: /home2/sssdad.com/posixuser1_dom1 should equal /home2/sssdad.com/posixuser1_dom1)
:: [   PASS   ] :: checking shell with default_shell for posixuser1_dom1 (Assert: /bin/ksh should equal /bin/ksh)
:: [   PASS   ] :: checking homedir with fallback_homedir for posixuser1_dom2 (Assert: /home2/sssdad_tree.com/posixuser1_dom2 should equal /home2/sssdad_tree.com/posixuser1_dom2)
:: [   PASS   ] :: checking shell with default_shell for posixuser1_dom2 (Assert: /bin/ksh should equal /bin/ksh)
:: [   PASS   ] :: checking homedir with fallback_homedir for posixuser1_dom3.com (Assert: /home2/child1.sssdad.com/posixuser1_dom3 should equal /home2/child1.sssdad.com/posixuser1_dom3)
:: [   PASS   ] :: checking shell with default_shell for posixuser1_dom3.com (Assert: /bin/ksh should equal /bin/ksh)
:: [   LOG    ] :: Duration: 42s
:: [   LOG    ] :: Assertions: 12 good, 0 bad
:: [   PASS   ] :: RESULT: ad_forest_07: bz 1066096 not retrieving homedirs of AD users with posix attributes

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.