Bug 1346294 - ldap_group_external_member is no set for the IPA provider
Summary: ldap_group_external_member is no set for the IPA provider
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd
Version: 7.2
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: SSSD Maintainers
QA Contact: Steeve Goveas
URL:
Whiteboard:
Depends On:
Blocks: 1356433
TreeView+ depends on / blocked
 
Reported: 2016-06-14 13:25 UTC by Sumit Bose
Modified: 2016-11-04 07:19 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1356433 (view as bug list)
Environment:
Last Closed: 2016-11-04 07:19:10 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2016:2476 normal SHIPPED_LIVE sssd bug fix and enhancement update 2016-11-03 14:08:11 UTC

Description Sumit Bose 2016-06-14 13:25:41 UTC
Description of problem:
To fix #1311569 a new option ldap_group_external_member was added which should enable to IPA provider to read the external group members form the given attribute. Unfortunately ldap_group_external_member is not set by default and must be specified as 'ldap_group_external_member = ipaexternalmember' in sssd.conf to fix #1311569. It would be good to set it by default for the IPA provider.

Comment 3 Jakub Hrozek 2016-06-27 12:32:54 UTC
Since the bug was only in the 7.2.z backport of the patches, marking as MODIFIED. The correct code is already in te 7.3 rebase.

Comment 8 Varun Mylaraiah 2016-08-12 11:34:54 UTC
Verified

# rpm -q ipa-server sssd
ipa-server-4.4.0-7.el7.x86_64
sssd-1.14.0-18.el7.x86_64

# ipa group-add testgrp02
-----------------------
Added group "testgrp02"
-----------------------
  Group name: testgrp02
  GID: 64000014

# ipa group-add --desc='external group' ext_testgrp02 --external
---------------------------
Added group "ext_testgrp02"
---------------------------
  Group name: ext_testgrp02
  Description: external group

# ipa group-add-member ext_testgrp02 --external "ADTEST2.QE\adgroup1"
[member user]: 
[member group]: 
  Group name: ext_testgrp02
  Description: external group
  External member: S-1-5-21-1869981227-3608374679-2281468898-1106
-------------------------
Number of members added 1
-------------------------

# ipa group-add-member testgrp02
[member user]: 
[member group]: ext_testgrp02
  Group name: testgrp02
  GID: 64000014
  Member groups: ext_testgrp02
-------------------------
Number of members added 1
-------------------------

# getent group adgroup1@adtest2.qe
adgroup1@adtest2.qe:*:665801106:aduser1@adtest2.qe,aduser2@adtest2.qe

# getent group testgrp02@testrelm.test
testgrp02:*:64000014:aduser2@adtest2.qe,aduser1@adtest2.qe

Comment 10 errata-xmlrpc 2016-11-04 07:19:10 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-2476.html


Note You need to log in before you can comment on or make changes to this bug.