Bug 1311502 - [RFE] compat tree: show AD members of IPA groups
[RFE] compat tree: show AD members of IPA groups
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa (Show other bugs)
7.3
All Linux
urgent Severity urgent
: rc
: ---
Assigned To: IPA Maintainers
Namita Soman
: FutureFeature, ZStream
Depends On: 1301901
Blocks:
  Show dependency treegraph
 
Reported: 2016-02-24 06:40 EST by Jan Kurik
Modified: 2016-05-12 05:58 EDT (History)
15 users (show)

See Also:
Fixed In Version: ipa-4.2.0-15.el7_2.9
Doc Type: Enhancement
Doc Text:
The Schema Compatibility plug-in did not expose users from a trusted Active Directory (AD) forest as part of IdM groups even if the group membership was defined in IdM. This prevented legacy clients from subjecting AD users to sudo rules and group-restricting access rules. External members of IdM groups are now resolved and their information exported to the plug-in, thus improving compatibility with legacy clients.
Story Points: ---
Clone Of: 1301901
Environment:
Last Closed: 2016-05-12 05:58:44 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Kurik 2016-02-24 06:40:52 EST
This bug has been copied from bug #1301901 and has been proposed
to be backported to 7.2 z-stream (EUS).
Comment 6 Sudhir Menon 2016-03-16 06:24:49 EDT
Verified using 

ipa-server-4.2.0-15.el7_2.10.x86_64
sssd-1.13.0-40.el7_2.2.x86_64

===IPA Server===
1. Created Global Security Group added members from parent domain.
[root@host2 ~]# getent group group1@pne.qe
group1@pne.qe:*:760201726:user2@pne.qe,user1@pne.qe

2. Created Global Security Group added members from child domain.
[root@host2 ~]# getent group group2@chd.pne.qe
group2@chd.pne.qe:*:1269801135:user4@chd.pne.qe,user3@chd.pne.qe

3. Created Universal Security Group and added members from parent/child domain.
[root@host2 ~]# getent group universal1@pne.qe
universal1@pne.qe:*:760201725:user3@chd.pne.qe,user1@pne.qe

4. Created Universal Security Group and added members from parent/child domain.
[root@host2 ~]# getent group universe2@chd.pne.qe
universe2@chd.pne.qe:*:1269801136:user4@chd.pne.qe,user2@pne.qe

5. After removing user from group, found that getent group is also updated.

a. After removing user3@chd.pne.qe from universal1@pne.qe group
[root@host2 ~]# getent group universal1@pne.qe
universal1@pne.qe:*:760201725:user1@pne.qe
 
b. After removing user2@pne.qe from universe2@chd.pne.qe group
[root@host2 ~]# getent group universe2@chd.pne.qe
universe2@chd.pne.qe:*:1269801136:user4@chd.pne.qe
 
6. External Group
[root@host2 ~]# ipa group-add --external ext_ad_administrators --desc "PNE.QE\Administrators"
-----------------------------------
Added group "ext_ad_administrators"
-----------------------------------
  Group name: ext_ad_administrators
  Description: PNE.QE\Administrators
 
[root@host2 ~]# ipa group-add-member ext_ad_administrators --external "PNE\Domain Admins"
[member user]:
[member group]:
  Group name: ext_ad_administrators
  Description: PNE.QE\Administrators
  External member: S-1-5-21-2828791737-1866347024-3967946728-512
-------------------------
Number of members added 1
-------------------------
 
[root@host2 ~]# ipa group-add ad_administrators
-------------------------------
Added group "ad_administrators"
-------------------------------
  Group name: ad_administrators
  GID: 967200021
 
[root@host2 ~]# ipa group-add-member ad_administrators --group ext_ad_administrators
  Group name: ad_administrators
  GID: 967200021
  Member groups: ext_ad_administrators
-------------------------
Number of members added 1
-------------------------
 
[root@host2 ~]# getent group ad_administrators
ad_administrators:*:967200021:Administrator@pne.qe

The same output was seen on the IPA-client.
Comment 8 errata-xmlrpc 2016-05-12 05:58:44 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-1036.html

Note You need to log in before you can comment on or make changes to this bug.