Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1213947

Summary: Group resolution is inconsistent with group overrides
Product: Red Hat Enterprise Linux 6 Reporter: Steeve Goveas <sgoveas>
Component: sssdAssignee: Sumit Bose <sbose>
Status: CLOSED ERRATA QA Contact: Namita Soman <nsoman>
Severity: unspecified Docs Contact: Tomas Capek <tcapek>
Priority: medium    
Version: 6.7CC: atolani, cww, drieden, grajaiya, jgalipea, jhrozek, lslebodn, mkosek, mzidek, nsoman, pbrezina, preichl, sbose, sumenon
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: sssd-1.12.4-38.el6 Doc Type: Known Issue
Doc Text:
Group resolution is inconsistent with group overrides If a group GID is overriden, running the "id" command reports an incorrect GID. To work around this problem, run the "getent group" command on the overriden group.
 Story Points: ---
Clone Of:
: 1214719 (view as bug list) Environment:
Last Closed: 2016-05-10 20:22:29 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1172231, 1214719, 1272422    
Attachments:
Description Flags
Console output none

Description Steeve Goveas 2015-04-21 15:22:29 UTC 
Description of problem:
If id user is run first, then all groups are resolved without the group override for the user's group. Running getent for the group on an empty cache applies the override but id for the user does not resolve all group memberships.

Version-Release number of selected component (if applicable):
[root@ibm-x3250m4-04 ~]# rpm -q sssd ipa-client
sssd-1.12.4-29.el6.x86_64
ipa-client-3.0.0-46.el6.x86_64

How reproducible:
always

Steps to Reproduce:

On Server

* No other view applied on any client host

[root@sideswipe ~]# ipa idoverridegroup-find 'default trust view'
----------------------------
2 Group ID overrides matched
----------------------------
  Anchor to override: adgroup1
  GID: 12121212

  Anchor to override: adgroup1.qe
  GID: 78787878
----------------------------
Number of entries returned 2
----------------------------

[root@sideswipe ~]# ipa idoverrideuser-find 'default trust view'
---------------------------
4 User ID overrides matched
---------------------------
  Anchor to override: aduser07
  User login: syncuser07

  Anchor to override: aduser1
  UID: 1902400018
  GID: 1902400018
  Home directory: /home/aduser1

  Anchor to override: aduser1.qe
  UID: 999999991
  GID: 999999991
  Home directory: /home/pune/aduser1
  Login shell: /bin/tcsh

  Anchor to override: aduser2
  UID: 1902400017
  GID: 1902400017
  Home directory: /home/aduser2
----------------------------
Number of entries returned 4
----------------------------
[root@sideswipe ~]# service sssd stop ; rm -f /var/lib/sss/{db,mc}/* ; service sssd start
Redirecting to /bin/systemctl stop  sssd.service
Redirecting to /bin/systemctl start  sssd.service

On Client1

[root@ibm-x3250m4-04 ~]# service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start
Stopping sssd: [  OK  ]
Starting sssd: [  OK  ]

[root@ibm-x3250m4-04 ~]# id aduser1.qe
uid=999999991(aduser1.qe) gid=999999991(aduser1.qe) groups=999999991(aduser1.qe),1148402424(adunigroup1),839001172(adgroup2.qe),839001120(adgroup1.qe),839000513(domain users.qe)

[root@ibm-x3250m4-04 ~]# getent group adgroup1.qe
adgroup1.qe:*:839001120:aduser1.qe,aduser2.qe

[root@ibm-x3250m4-04 ~]# getent group adgroup1
adgroup1:*:12121212:aduser2,aduser1


* Clear sssd cache on server and client

[root@ibm-x3250m4-04 ~]# service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start
Stopping sssd: [  OK  ]
Starting sssd: [  OK  ]

[root@ibm-x3250m4-04 ~]# getent group adgroup1.qe
adgroup1.qe:*:78787878:aduser1.qe,aduser2.qe

[root@ibm-x3250m4-04 ~]# id aduser1.qe
uid=999999991(aduser1.qe) gid=999999991(aduser1.qe) groups=999999991(aduser1.qe),78787878(adgroup1.qe)

[root@ibm-x3250m4-04 ~]# getent group adgroup1
adgroup1:*:12121212:aduser2,aduser1
Comment 2 Jakub Hrozek 2015-04-24 14:28:43 UTC 
Upstream ticket:
https://fedorahosted.org/sssd/ticket/2633
Comment 3 Jakub Hrozek 2015-05-06 04:02:30 UTC 
Fixed upstream:
    master:
        2263c6dd1242c92253240f4998c86a04b6a0ca3a
        145578006684481434ced78461ab8d1c3570f478
        cffe3135f29c737f2598f3c1384bfba1694fb843
        e87badc0f6fb20a443cf12bde9582ecbc2aef727 
    sssd-1-12:
        eaf656843831d579f30f94154d88aba2201c1712
        58a19d50888b1a7da0ee78b49e7d3dcbebc8614d
        f643fadbd072a9d3725f5f750340d5b13628ce6a
        24905d4ecbf210687e385449448f5a5ec97d2833
Comment 10 Sudhir Menon 2016-02-17 09:43:23 UTC 
Created attachment 1127898 [details]
Console output
Comment 12 Sudhir Menon 2016-02-22 14:57:04 UTC 
Verified using ipa-client-3.0.0-50.el6.x86_64 on RHEL6.8 IPA-Client with RHEL 7.2 IPA (ipa-server-4.2.0-15.el7_2.3.x86_64) trust with Windows2K12 R2 AD. 

id command was not displaying output on the client because there was no existing group in the trusted AD having the GID set in the POSIX Attribute similar to that of the overridden value specified while modifying the trusted user in 'Default Trust View'

After adding the groups the id output is displayed correctly on the IPA-client.

[root@r683 ~]# id idviewuser1
uid=10000(syncuser07) gid=10001(agroup1) groups=10001(agroup1),10000(domain users)
[root@r683 ~]# id idviewuser2
uid=1902400018(idviewuser2) gid=1902400018(test2) groups=1902400018(test2),10000(domain users)
[root@r683 ~]# id idviewuser3
uid=1902400017(idviewuser3) gid=1902400017(test3) groups=1902400017(test3),10000(domain users)
[root@r683 ~]# id test1.qe
uid=999999991(test1.qe) gid=999999991(test4) groups=999999991(test4),10000(domain users)
Comment 14 errata-xmlrpc 2016-05-10 20:22:29 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-0782.html