Red Hat Bugzilla – Bug 1092766
Simple access fails to look up primary group when using sssd-ad until running the id command.
Last modified: 2014-10-14 00:48:25 EDT
Description of problem: When attempting to login in the morning (most likely empty cache) access is denied by the simple access provider until logging in as root and running "id username" on the user. After this access is allowed. This is occurring on all 4 servers. SSSD is configured using sssd-ad and access is restricted using simple access with the user's primary group listed for simple access. This looks like a degradation of bug 670763 or something similar that wasn't fixed for sssd-ad Version-Release number of selected component (if applicable): sssd-1.9.2-129.el6_5.4.x86_64 How reproducible: I had the customer use the following: https://access.redhat.com/site/articles/704743 Steps to Reproduce: 1. 2. 3. Actual results: required to run "id username" before simple access succeeds Expected results: access is allowed everytime Additional info: The sssd.conf configuration [domain/default] id_provider = ad ldap_id_mapping = False ldap_schema = ad access_provider = simple simple_allow_groups = primarygroup ad_server = adserver.domain ad_domain = DOMAIN debug_level = 9 [sssd] services = nss, pam config_file_version = 2 debug_level = 9 domains = default [nss] debug_level = 9 [pam] debug_level = 9 [sudo] debug_level = 9
Hello Henry, I have a local replication of the problem, so I'll try to investigate. Regards, Pavel Reichl
Upstream ticket: https://fedorahosted.org/sssd/ticket/2334
Just to clarify replication - I believe this bug is happening only for users with POSIX attributes (please be sure to set "ldap_id_mapping = False" as Henry stated in 1st comment).
Fixed upstream: * master: fc731b54cd74e6732f1e33c7cc4ed49cab0f7c90 * sssd-1-11: 356b2dc5b81b073cfe1734df656fd34bef61c39d
Verified, simple groups are working in sssd-client-1.11.6-14.el6.x86_64 on current RHEL 6.6 nightly. Regardless of which group the member is in, primary group, secondary or tertiary. Testing was done against AD 2k12 with UNIX attributes enabled. Note, might want to modify the man page to give examples of adding groups with white spaces in the string. Spent sometime trying to escape the space or put the string "domain users" in quotes and single quotes, none of these worked but leaving it alone was successful. e.g. simple_allow_groups = domain users
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2014-1375.html