Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Created attachment 875617[details]
logs for each join and test
Description of problem:
Issues resolving uses for child or second tree domain when the sssd client system is joined to the child or second tree.
Version-Release number of selected component (if applicable):
sssd-1.11.2-58.el7
How reproducible:
every time.
Steps to Reproduce:
AD layout:
Root domain sssdad.com
Child domain child1.sssdad.com
Second tree domain sssdad_tree.com
Client joined to one domain using ad_provider defaults for ldap_id_mapping
When joined to sssdad.com all users resolve.
id administrator
id administrator
id administrator.com
id user1_dom1
id user1_dom2
id user1_dom3.com
When joined to sssdad_tree.com the following users do not resolve.
id administrator.com
id user1_dom3.com
When joined to child1.sssdad.com the following users do not resolve.
id administrator
id user1_dom2
The set of logs are from tests on each domain join.
Administrator entry when connected to sssdad_tree.com
(Mon Mar 17 11:33:13 2014) [sssd[be[sssdad_tree.com]]] [sdap_save_user] (0x2000): Adding originalDN [CN=Administrator,CN=Users,DC=child1,DC=sssdad,DC=com] to attributes of [Administrator].
No entry for CN=Administrator,CN=Users,DC=sssdad_tree,DC=com in sssd_child1.sssdad.com.log.
No entries were logged for user1_dom3.com in sssd_sssdad_tree.com.log and user1_dom2 in sssd_child1.sssdad.com.log.
Expected results:
All forest users should resolve when joined to any trusted domain.
Thank you for reporting this bug, I was able to reproduce it with Jeremy's help.
I'm not 100% sure about the fix yet and I'd like to discuss it with the other developers, but in short, I think we should connect to the forest root in order to download the full list of domains. There is a catch with our current implementation of SRV resolution, which doesn't allow changing the domain on the fly (first for forest root, then for domain we're enrolled with).
This request was resolved in Red Hat Enterprise Linux 7.0.
Contact your manager or support representative in case you have further questions about the request.
Created attachment 875617 [details] logs for each join and test Description of problem: Issues resolving uses for child or second tree domain when the sssd client system is joined to the child or second tree. Version-Release number of selected component (if applicable): sssd-1.11.2-58.el7 How reproducible: every time. Steps to Reproduce: AD layout: Root domain sssdad.com Child domain child1.sssdad.com Second tree domain sssdad_tree.com Client joined to one domain using ad_provider defaults for ldap_id_mapping When joined to sssdad.com all users resolve. id administrator id administrator id administrator.com id user1_dom1 id user1_dom2 id user1_dom3.com When joined to sssdad_tree.com the following users do not resolve. id administrator.com id user1_dom3.com When joined to child1.sssdad.com the following users do not resolve. id administrator id user1_dom2 The set of logs are from tests on each domain join. Administrator entry when connected to sssdad_tree.com (Mon Mar 17 11:33:13 2014) [sssd[be[sssdad_tree.com]]] [sdap_save_user] (0x2000): Adding originalDN [CN=Administrator,CN=Users,DC=child1,DC=sssdad,DC=com] to attributes of [Administrator]. No entry for CN=Administrator,CN=Users,DC=sssdad_tree,DC=com in sssd_child1.sssdad.com.log. No entries were logged for user1_dom3.com in sssd_sssdad_tree.com.log and user1_dom2 in sssd_child1.sssdad.com.log. Expected results: All forest users should resolve when joined to any trusted domain.