Bug 1301655 - Getent ignores netgroups in /etc/passwd with passwd_compat sss [NEEDINFO]
Getent ignores netgroups in /etc/passwd with passwd_compat sss
Status: NEW
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: glibc (Show other bugs)
7.1
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: DJ Delorie
qe-baseos-tools
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-01-25 10:39 EST by Andreas N.
Modified: 2018-04-03 01:07 EDT (History)
12 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
dj: needinfo? (fo_ko)


Attachments (Terms of Use)

  None (edit)
Description Andreas N. 2016-01-25 10:39:37 EST
Description of problem:

If someone in nsswitch.conf uses the compat mode for passwd with sssd

passwd:         compat
passwd_compat:  sss

and in /etc/passwd the netgroup entry (e.g +@netgroup). With "getent passwd" the users in this ldap netgroup don't get listed. "getent passwd [username]" works perfectly fine. Also, if instead of netgroup "group", we write just a netgroup user (e.g. +username) it works as it should. The only problem is with groups.


How reproducible:
always


Steps to Reproduce:

1. Set in nsswitch.conf

passwd:         compat
passwd_compat:  sss

2. Set a netgroup group in /etc/passwd

+@netgroup

3. Do a "getent passwd"


Actual results:

only the local users of passwd get listed. ldap users in the netgroup don't get enumerated.


Expected results:

ldap users in the netgroup should be listed too.


Additional info:

This seems to be a really old bug. Take a look here https://www.redhat.com/archives/rhelv5-list/2011-September/msg00003.html
I tried to set the NIS domain but for me didn't work.
Comment 2 Jakub Hrozek 2016-01-25 17:10:48 EST
I admit I haven't really used the compat mode myself, but:
 1) Can you enumerate the users in the netgroup?
 2) did you enable enumerate=true in sssd.conf?
 3) can you request individual users?
Comment 3 Andreas N. 2016-01-26 04:25:38 EST
(In reply to Jakub Hrozek from comment #2)
> I admit I haven't really used the compat mode myself, but:
>  1) Can you enumerate the users in the netgroup?
>  2) did you enable enumerate=true in sssd.conf?
>  3) can you request individual users?

Hello Jakub,

1) If I give "getent netgroup [netgroup name]" it works as it should. It lists me the netgroup elements.

2) If you enable the enumerate in sssd.conf then you get a list with all the ldap users. That is why I wanted to do the enumeration with compat and passwd, in order to avoid the listing of all users in the ldap directory and just decide which netgroup users I want to get listed.Before the sssd times it used to be done like this.

3) Individual users can be requested. Like I said, if you write in passwd +username and do a "getent passwd" it works without problem. The problem is only with groups.
Comment 4 Jakub Hrozek 2016-01-27 10:00:35 EST
If the lookups work, then I think it's out of the hands of sssd and into the realm of libc..
Comment 5 Florian Weimer 2016-11-24 12:09:20 EST
On the glibc side, we need more verbose instructions how to configure a system so that it reproduces this issue.  Thanks.
Comment 7 DJ Delorie 2017-08-30 17:01:55 EDT
In my testing, I've found that I can reproduce this problem if I populate the netgroups like this:

nisNetgroupTriple: (testuser23000.example.com,,)

but if I instead populate the netgroups like this, it works correctly:

nisNetgroupTriple: (,testuser23456,)

Could you please check your ldap database and see how the nisNetgroupTriples are formatted?

Note You need to log in before you can comment on or make changes to this bug.