1304992 – Handle overriden name of members in the memberUid attribute

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1304992 - Handle overriden name of members in the memberUid attribute

Summary: Handle overriden name of members in the memberUid attribute

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	sssd
Sub Component:
Version:	7.3
Hardware:	All
OS:	Linux
Priority:	high
Severity:	high
Target Milestone:	rc
Target Release:	---
Assignee:	SSSD Maintainers
QA Contact:	Steeve Goveas
Docs Contact:
URL:
Whiteboard:
Depends On:	1366569
Blocks:
TreeView+	depends on / blocked

Reported:	2016-02-05 09:16 UTC by Jakub Hrozek
Modified:	2020-05-02 18:18 UTC (History)
CC List:	11 users (show)
Fixed In Version:	sssd-1.14.0-14.el7
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2016-11-04 07:15:50 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)
sssd log (24.82 KB, text/plain) 2016-08-12 06:28 UTC, Sudhir Menon	no flags	Details
sssd domain log (222.46 KB, text/plain) 2016-08-12 06:28 UTC, Sudhir Menon	no flags	Details
sssd nsss log (19.72 KB, text/plain) 2016-08-12 06:29 UTC, Sudhir Menon	no flags	Details
View All

Links
System	ID	Priority	Status	Summary	Last Updated
FedoraHosted SSSD	2948	None	None	None	2016-07-06 20:53:56 UTC
Github	SSSD sssd issues 3989	None	closed	Handle overriden name of members in the memberUid attribute	2020-05-02 18:18:41 UTC
Red Hat Product Errata	RHEA-2016:2476	normal	SHIPPED_LIVE	sssd bug fix and enhancement update	2016-11-03 14:08:11 UTC

Description Jakub Hrozek 2016-02-05 09:16:16 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/sssd/ticket/2948

Currently when AD user's name is overriden in the default trust view, then getgr* requests still report the original name:
{{{
$ getent passwd administrator.test
admin_from_parent.test:*:962400500:962400500:Administrator:/home/win.trust.test/administrator:
$ getent group admins.test
admins.test:*:962410634:administrator.test
}}}

This is because the memberUid attribute is generated when the user is added, before the overrides are applied. We need to rename the entry when the login override is applied because the memberUid is only generated based on the name user's attribute.

Comment 1 Jakub Hrozek 2016-06-27 08:48:33 UTC

Upstream didn't completely fix this bug and since there is no downstream customer case attached, I think it's fine to wait until 7.4

Comment 8 Jakub Hrozek 2016-07-29 13:10:37 UTC

* master:
    * f2e8a7c3230fac11175c0bd17c14c66a8e9b25ad
    * 160ba891ec483c5b7d2a3fcca5bd992fc790efe0
    * 17bfd9f69251781140e4b2b55ffeb649d7a79e86
    * 1594701fbdc341069e11cff9a85e7a795e52db3d

Comment 10 Sudhir Menon 2016-08-12 06:27:32 UTC

Tested using 
sssd-1.14.0-18.el7.x86_64 
ipa-server-4.4.0-7.el7.x86_64

Observations:
Although the id command displays the overridden login name , but getent group returns the actual user name e.g test2 instead of test22.
Attaching the sssd logs for the test.

Verified using the below steps
1. Create trust with windows AD.
2. User test2 is a member of sales group in Windows AD
3. now run id command on ipa-server

[root@master sssd]# id test2
uid=558001486(test2) gid=558001486(test2) groups=558001486(test2)

[root@master sssd]# getent passwd test2
test2:*:558001486:558001486:test2:/home/pne.qe/test2:

[root@master sssd]# ipa idview-find
-----------------
1 ID View matched
-----------------
  ID View Name: Default Trust View
  Description: Default Trust View for AD users. Should not be deleted.
----------------------------
Number of entries returned 1
----------------------------

[root@master sssd]# ipa idoverrideuser-add 
ID View Name: Default Trust View
Anchor to override: test2
-------------------------------------
Added User ID override "test2"
-------------------------------------
  Anchor to override: test2

[root@master sssd]# ipa idoverrideuser-mod --login=test22 
ID View Name: Default trust view
Anchor to override: test2
-------------------------------------------
Modified an User ID override "test2"
-------------------------------------------
  Anchor to override: test2
  User login: test22

[root@master sssd]# getent passwd test2
test22:*:558001486:558001486:test2:/home/pne.qe/test2:

[root@master sssd]# getent group sales
sales:*:558001488:test2

Comment 11 Sudhir Menon 2016-08-12 06:28:00 UTC

Created attachment 1190268 [details]
sssd log

Comment 12 Sudhir Menon 2016-08-12 06:28:28 UTC

Created attachment 1190269 [details]
sssd domain log

Comment 13 Sudhir Menon 2016-08-12 06:29:03 UTC

Created attachment 1190270 [details]
sssd nsss log

Comment 14 Sudhir Menon 2016-08-12 06:46:09 UTC

Found that the getent group on master/client show different result.

Please note that 'service sssd stop ; rm -frv /var/lib/sss/{db,mc}/* ; service sssd start' was run on both master and client machines before running the command.

[root@master sssd]# getent group sales
sales:*:558001488:test2

[root@client ~]# getent group sales
sales:*:558001488:test22

Comment 15 Sudhir Menon 2016-08-12 12:25:28 UTC

Note:
After manually adding sss as lookup in nsswitch.conf file against initgroups, the correct results are shown.

===IPA Server===
[root@ipaserver sssd]# grep initgroups /etc/nsswitch.conf
initgroups: files sss

[root@ipaserver sssd]# id test2
uid=558001486(test22) gid=558001486(test22) groups=558001486(test22),558000513(domain users),558001488(sales)

[root@ipaserver sssd]# getent group sales
sales:*:558001488:test22

===IPA Client===
[root@client ~]# sss_cache -E
[root@client ~]# id test2
uid=558001486(test22) gid=558001486(test22) groups=558001486(test22),558000513(domain users),558001488(sales)
[root@client ~]# getent group sales
sales:*:558001488:test22

Comment 16 Lukas Slebodnik 2016-08-12 13:04:09 UTC

(In reply to Sudhir Menon from comment #15)
> Note:
> After manually adding sss as lookup in nsswitch.conf file against
> initgroups, the correct results are shown.
> 
It is not expected to changes nsswitch.conf
The line for initgroups is commented out as part of "authconfig --enablesssd --update"

ipa-client-install and realmd uses authconfig underneath.
So the nsswitch.conf should be properly configured

Comment 17 Sudhir Menon 2016-08-12 13:10:53 UTC

Lukas,
You meant to say that the fix is needed in authconfig and we shouldn't be making any changes in /etc/nsswitch.conf, right?

Comment 18 Lukas Slebodnik 2016-08-12 13:41:21 UTC

(In reply to Sudhir Menon from comment #17)
> Lukas,
> You meant to say that the fix is needed in authconfig and we shouldn't be
> making any changes in /etc/nsswitch.conf, right?

You can test authconfig with following steps

[root@b29b086114f1 /]# grep initgroups /etc/nsswitch.conf
initgroups: files

[root@b29b086114f1 /]# authconfig --enablesssd --update
[root@b29b086114f1 /]# 
[root@b29b086114f1 /]# grep initgroups /etc/nsswitch.conf
#initgroups: files

If result is not the same then it's bug in authconfig.
otherwise there is a bug in ipa-{server,client}-install

Comment 19 Sudhir Menon 2016-08-12 13:43:03 UTC

[root@ipaserver sssd]# grep initgroups /etc/nsswitch.conf
initgroups: files
[root@ipaserver sssd]# authconfig --enablesssd --update
[root@ipaserver sssd]# grep initgroups /etc/nsswitch.conf
initgroups: files

Comment 20 Jakub Hrozek 2016-08-12 13:44:41 UTC

(In reply to Lukas Slebodnik from comment #16)
> (In reply to Sudhir Menon from comment #15)
> > Note:
> > After manually adding sss as lookup in nsswitch.conf file against
> > initgroups, the correct results are shown.
> > 
> It is not expected to changes nsswitch.conf
> The line for initgroups is commented out as part of "authconfig --enablesssd
> --update"
> 
> ipa-client-install and realmd uses authconfig underneath.
> So the nsswitch.conf should be properly configured

Please see https://bugzilla.redhat.com/show_bug.cgi?id=1366569

Comment 21 Sudhir Menon 2016-08-16 09:51:32 UTC

Since there is already #bz1366569 to address the issue related to sss entry against initgroups in nsswitch.conf file. Marking the bug Verified as per comment #15.

Verified using 
sssd-1.14.0-18.el7.x86_64
ipa-server-4.4.0-7.el7.x86_64

Comment 23 errata-xmlrpc 2016-11-04 07:15:50 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-2476.html

Note You need to log in before you can comment on or make changes to this bug.