Bug 1171382
| Summary: | getent of AD universal group fails after group users login | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Steeve Goveas <sgoveas> |
| Component: | sssd | Assignee: | Sumit Bose <sbose> |
| Status: | CLOSED ERRATA | QA Contact: | Kaushik Banerjee <kbanerje> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.1 | CC: | grajaiya, greartes, jhrozek, lslebodn, mkosek, mzidek, nsoman, ovasik, pbrezina, preichl |
| Target Milestone: | rc | Keywords: | Regression |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | sssd-1.12.2-38.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-03-05 10:34:57 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1030699 | ||
Sumit planned to assess this one. Verified in version
ipa-server-4.1.0-13.el7.x86_64
sssd-ipa-1.12.2-39.el7.x86_64
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [ LOG ] :: ipa_trust_func_user_0016: check child user in forest group
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [ BEGIN ] :: Running 'service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start'
Redirecting to /bin/systemctl stop sssd.service
Redirecting to /bin/systemctl start sssd.service
:: [ PASS ] :: Command 'service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start' (Expected 0, got 0)
:: [ BEGIN ] :: Running 'sleep 5'
:: [ PASS ] :: Command 'sleep 5' (Expected 0, got 0)
:: [ BEGIN ] :: Running 'ssh_with_password aduser1.qe vm-idm-013.stv1911.test Secret123'
:: [ 21:03:11 ] :: Running: ssh -l "aduser1.qe" vm-idm-013.stv1911.test "echo 'login successful'
:: [ 21:03:17 ] :: ssh login successful
:: [ PASS ] :: Command 'ssh_with_password aduser1.qe vm-idm-013.stv1911.test Secret123' (Expected 0, got 0)
:: [ BEGIN ] :: Running 'ssh_with_password aduser1 vm-idm-013.stv1911.test Secret123'
:: [ 21:03:17 ] :: Running: ssh -l "aduser1" vm-idm-013.stv1911.test "echo 'login successful'
:: [ 21:03:22 ] :: ssh login successful
:: [ PASS ] :: Command 'ssh_with_password aduser1 vm-idm-013.stv1911.test Secret123' (Expected 0, got 0)
:: [ BEGIN ] :: Running 'sleep 10'
:: [ PASS ] :: Command 'sleep 10' (Expected 0, got 0)
:: [ BEGIN ] :: Running 'id aduser1.qe'
uid=839001130(aduser1.qe) gid=839001130(aduser1.qe) groups=839001130(aduser1.qe),1148402424(adunigroup1),839001172(adgroup2.qe),839001120(adgroup1.qe),839000513(domain users.qe)
:: [ PASS ] :: Command 'id aduser1.qe' (Expected 0, got 0)
:: [ BEGIN ] :: Running 'id aduser1'
uid=1148401313(aduser1) gid=1148401313(aduser1) groups=1148401313(aduser1),1148402424(adunigroup1),1148401449(adgroup1),1148402425(adgroup2),1148400513(domain users)
:: [ PASS ] :: Command 'id aduser1' (Expected 0, got 0)
:: [ BEGIN ] :: Running 'sleep 5'
:: [ PASS ] :: Command 'sleep 5' (Expected 0, got 0)
:: [ BEGIN ] :: Running 'getent group adunigroup1 > ipa_trust_func_user_0016.Sv0fna 2>&1'
:: [ PASS ] :: Command 'getent group adunigroup1 > ipa_trust_func_user_0016.Sv0fna 2>&1' (Expected 0, got 0)
:: [ BEGIN ] :: Running 'cat ipa_trust_func_user_0016.Sv0fna'
adunigroup1:*:1148402424:aduser1.qe,aduser1
:: [ PASS ] :: Command 'cat ipa_trust_func_user_0016.Sv0fna' (Expected 0, got 0)
:: [ PASS ] :: File 'ipa_trust_func_user_0016.Sv0fna' should contain 'aduser1.qe'
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0441.html |
Description of problem: getent of AD universal group does not work as expected after group users login Version-Release number of selected component (if applicable): sssd-1.12.2-28.el7.x86_64 How reproducible: often Steps to Reproduce: 1. Install IPA 2. Add trust with AD 3. Add a universal group on AD with users from both root and child AD domains 4. Login logout on the ipa client as each AD user from the group 5. run getent for the AD universal group Actual results: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: ipa_trust_func_user_0016: check child user in forest group :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ BEGIN ] :: Running 'service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start' Redirecting to /bin/systemctl stop sssd.service Redirecting to /bin/systemctl start sssd.service :: [ PASS ] :: Command 'service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start' (Expected 0, got 0) :: [ BEGIN ] :: Running 'ssh_with_password aduser1.qe vm-idm-044.stv1911.test Secret123' :: [ 13:37:55 ] :: Running: ssh -l "aduser1.qe" vm-idm-044.stv1911.test "echo 'login successful' :: [ 13:38:05 ] :: ssh login successful :: [ PASS ] :: Command 'ssh_with_password aduser1.qe vm-idm-044.stv1911.test Secret123' (Expected 0, got 0) :: [ BEGIN ] :: Running 'ssh_with_password aduser1 vm-idm-044.stv1911.test Secret123' :: [ 13:38:05 ] :: Running: ssh -l "aduser1" vm-idm-044.stv1911.test "echo 'login successful' :: [ 13:38:08 ] :: ssh login successful :: [ PASS ] :: Command 'ssh_with_password aduser1 vm-idm-044.stv1911.test Secret123' (Expected 0, got 0) :: [ BEGIN ] :: Running 'sleep 5' :: [ PASS ] :: Command 'sleep 5' (Expected 0, got 0) :: [ BEGIN ] :: Running 'id aduser1.qe' uid=839001130(aduser1.qe) gid=839001130(aduser1.qe) groups=839001130(aduser1.qe),839000513(domain users.qe),1148402424(adunigroup1),839001120(adgroup1.qe),839001172(adgroup2.qe) :: [ PASS ] :: Command 'id aduser1.qe' (Expected 0, got 0) :: [ BEGIN ] :: Running 'id aduser1' uid=1148401313(aduser1) gid=1148401313(aduser1) groups=1148401313(aduser1),1148402424(adunigroup1),1148401449(adgroup1),1148402425(adgroup2),1148400513(domain users) :: [ PASS ] :: Command 'id aduser1' (Expected 0, got 0) :: [ BEGIN ] :: Running 'getent group adunigroup1 > ipa_trust_func_user_0016.T4Wgrs 2>&1' :: [ PASS ] :: Command 'getent group adunigroup1 > ipa_trust_func_user_0016.T4Wgrs 2>&1' (Expected 0, got 0) :: [ BEGIN ] :: Running 'cat ipa_trust_func_user_0016.T4Wgrs' adunigroup1:*:1148402424:aduser1 :: [ PASS ] :: Command 'cat ipa_trust_func_user_0016.T4Wgrs' (Expected 0, got 0) :: [ FAIL ] :: File 'ipa_trust_func_user_0016.T4Wgrs' should contain 'aduser1.qe' Expected results: getent should list both AD users Additional info: