Red Hat Bugzilla – Bug 1171382
getent of AD universal group fails after group users login
Last modified: 2015-09-29 02:50:04 EDT
Description of problem: getent of AD universal group does not work as expected after group users login Version-Release number of selected component (if applicable): sssd-1.12.2-28.el7.x86_64 How reproducible: often Steps to Reproduce: 1. Install IPA 2. Add trust with AD 3. Add a universal group on AD with users from both root and child AD domains 4. Login logout on the ipa client as each AD user from the group 5. run getent for the AD universal group Actual results: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: ipa_trust_func_user_0016: check child user in forest group :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ BEGIN ] :: Running 'service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start' Redirecting to /bin/systemctl stop sssd.service Redirecting to /bin/systemctl start sssd.service :: [ PASS ] :: Command 'service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start' (Expected 0, got 0) :: [ BEGIN ] :: Running 'ssh_with_password aduser1@pune.adtest.qe vm-idm-044.stv1911.test Secret123' :: [ 13:37:55 ] :: Running: ssh -l "aduser1@pune.adtest.qe" vm-idm-044.stv1911.test "echo 'login successful' :: [ 13:38:05 ] :: ssh login successful :: [ PASS ] :: Command 'ssh_with_password aduser1@pune.adtest.qe vm-idm-044.stv1911.test Secret123' (Expected 0, got 0) :: [ BEGIN ] :: Running 'ssh_with_password aduser1@adtest.qe vm-idm-044.stv1911.test Secret123' :: [ 13:38:05 ] :: Running: ssh -l "aduser1@adtest.qe" vm-idm-044.stv1911.test "echo 'login successful' :: [ 13:38:08 ] :: ssh login successful :: [ PASS ] :: Command 'ssh_with_password aduser1@adtest.qe vm-idm-044.stv1911.test Secret123' (Expected 0, got 0) :: [ BEGIN ] :: Running 'sleep 5' :: [ PASS ] :: Command 'sleep 5' (Expected 0, got 0) :: [ BEGIN ] :: Running 'id aduser1@pune.adtest.qe' uid=839001130(aduser1@pune.adtest.qe) gid=839001130(aduser1@pune.adtest.qe) groups=839001130(aduser1@pune.adtest.qe),839000513(domain users@pune.adtest.qe),1148402424(adunigroup1@adtest.qe),839001120(adgroup1@pune.adtest.qe),839001172(adgroup2@pune.adtest.qe) :: [ PASS ] :: Command 'id aduser1@pune.adtest.qe' (Expected 0, got 0) :: [ BEGIN ] :: Running 'id aduser1@adtest.qe' uid=1148401313(aduser1@adtest.qe) gid=1148401313(aduser1@adtest.qe) groups=1148401313(aduser1@adtest.qe),1148402424(adunigroup1@adtest.qe),1148401449(adgroup1@adtest.qe),1148402425(adgroup2@adtest.qe),1148400513(domain users@adtest.qe) :: [ PASS ] :: Command 'id aduser1@adtest.qe' (Expected 0, got 0) :: [ BEGIN ] :: Running 'getent group adunigroup1@adtest.qe > ipa_trust_func_user_0016.T4Wgrs 2>&1' :: [ PASS ] :: Command 'getent group adunigroup1@adtest.qe > ipa_trust_func_user_0016.T4Wgrs 2>&1' (Expected 0, got 0) :: [ BEGIN ] :: Running 'cat ipa_trust_func_user_0016.T4Wgrs' adunigroup1@adtest.qe:*:1148402424:aduser1@adtest.qe :: [ PASS ] :: Command 'cat ipa_trust_func_user_0016.T4Wgrs' (Expected 0, got 0) :: [ FAIL ] :: File 'ipa_trust_func_user_0016.T4Wgrs' should contain 'aduser1@pune.adtest.qe' Expected results: getent should list both AD users Additional info:
Sumit planned to assess this one.
Verified in version ipa-server-4.1.0-13.el7.x86_64 sssd-ipa-1.12.2-39.el7.x86_64 :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: ipa_trust_func_user_0016: check child user in forest group :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ BEGIN ] :: Running 'service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start' Redirecting to /bin/systemctl stop sssd.service Redirecting to /bin/systemctl start sssd.service :: [ PASS ] :: Command 'service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start' (Expected 0, got 0) :: [ BEGIN ] :: Running 'sleep 5' :: [ PASS ] :: Command 'sleep 5' (Expected 0, got 0) :: [ BEGIN ] :: Running 'ssh_with_password aduser1@pune.adtest.qe vm-idm-013.stv1911.test Secret123' :: [ 21:03:11 ] :: Running: ssh -l "aduser1@pune.adtest.qe" vm-idm-013.stv1911.test "echo 'login successful' :: [ 21:03:17 ] :: ssh login successful :: [ PASS ] :: Command 'ssh_with_password aduser1@pune.adtest.qe vm-idm-013.stv1911.test Secret123' (Expected 0, got 0) :: [ BEGIN ] :: Running 'ssh_with_password aduser1@adtest.qe vm-idm-013.stv1911.test Secret123' :: [ 21:03:17 ] :: Running: ssh -l "aduser1@adtest.qe" vm-idm-013.stv1911.test "echo 'login successful' :: [ 21:03:22 ] :: ssh login successful :: [ PASS ] :: Command 'ssh_with_password aduser1@adtest.qe vm-idm-013.stv1911.test Secret123' (Expected 0, got 0) :: [ BEGIN ] :: Running 'sleep 10' :: [ PASS ] :: Command 'sleep 10' (Expected 0, got 0) :: [ BEGIN ] :: Running 'id aduser1@pune.adtest.qe' uid=839001130(aduser1@pune.adtest.qe) gid=839001130(aduser1@pune.adtest.qe) groups=839001130(aduser1@pune.adtest.qe),1148402424(adunigroup1@adtest.qe),839001172(adgroup2@pune.adtest.qe),839001120(adgroup1@pune.adtest.qe),839000513(domain users@pune.adtest.qe) :: [ PASS ] :: Command 'id aduser1@pune.adtest.qe' (Expected 0, got 0) :: [ BEGIN ] :: Running 'id aduser1@adtest.qe' uid=1148401313(aduser1@adtest.qe) gid=1148401313(aduser1@adtest.qe) groups=1148401313(aduser1@adtest.qe),1148402424(adunigroup1@adtest.qe),1148401449(adgroup1@adtest.qe),1148402425(adgroup2@adtest.qe),1148400513(domain users@adtest.qe) :: [ PASS ] :: Command 'id aduser1@adtest.qe' (Expected 0, got 0) :: [ BEGIN ] :: Running 'sleep 5' :: [ PASS ] :: Command 'sleep 5' (Expected 0, got 0) :: [ BEGIN ] :: Running 'getent group adunigroup1@adtest.qe > ipa_trust_func_user_0016.Sv0fna 2>&1' :: [ PASS ] :: Command 'getent group adunigroup1@adtest.qe > ipa_trust_func_user_0016.Sv0fna 2>&1' (Expected 0, got 0) :: [ BEGIN ] :: Running 'cat ipa_trust_func_user_0016.Sv0fna' adunigroup1@adtest.qe:*:1148402424:aduser1@pune.adtest.qe,aduser1@adtest.qe :: [ PASS ] :: Command 'cat ipa_trust_func_user_0016.Sv0fna' (Expected 0, got 0) :: [ PASS ] :: File 'ipa_trust_func_user_0016.Sv0fna' should contain 'aduser1@pune.adtest.qe'
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0441.html