RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1391064 - MAN: Document AD provider uses tokengroups by default
Summary: MAN: Document AD provider uses tokengroups by default
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd
Version: 7.0
Hardware: All
OS: Linux
unspecified
low
Target Milestone: pre-dev-freeze
: 7.4
Assignee: SSSD Maintainers
QA Contact: Dan Lavu
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-11-02 13:56 UTC by Ming Davies
Modified: 2020-05-02 18:32 UTC (History)
7 users (show)

Fixed In Version: sssd-1.15.0-2.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-08-01 09:00:03 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 4247 0 None closed Update man pages for any AD provider config options that differ from ldap/krb5 providers defaults 2020-07-08 16:32:40 UTC
Github SSSD sssd issues 4266 0 None closed MAN: Document AD provider uses tokengroups by default 2020-07-08 16:32:40 UTC
Red Hat Product Errata RHEA-2017:2294 0 normal SHIPPED_LIVE sssd bug fix and enhancement update 2017-08-01 12:39:55 UTC

Description Ming Davies 2016-11-02 13:56:26 UTC
Description of problem:
AD provider uses tokengroups by default but it's unclear from the man page that this is the case.


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 3 Jakub Hrozek 2016-11-07 15:06:09 UTC
Upstream ticket:
https://fedorahosted.org/sssd/ticket/3233

Comment 5 Lukas Slebodnik 2016-11-11 09:41:32 UTC
Upstream ticket:
https://fedorahosted.org/sssd/ticket/3214

Comment 6 Jakub Hrozek 2016-11-17 08:49:22 UTC
master:
6e27e8572f671de575d9ac2a34a677d9efc24fbc
8caf7ba5005b3be5447311713ad2b58169f9d32f

Comment 8 Dan Lavu 2017-05-31 20:59:40 UTC
Verified against sssd-1.15.2-33.el7.x86_64

ldap_id_mapping (boolean)

Specifies that SSSD should attempt to map user and group IDs from the ldap_user_objectsid and ldap_group_objectsid attributes instead of relying on ldap_user_uid_number and ldap_group_gid_number.

Currently this feature supports only ActiveDirectory objectSID mapping.

Default: false



krb5_validate (boolean)

Verify with the help of krb5_keytab that the TGT obtained has not been spoofed. The keytab is checked for entries sequentially, and the first entry with a matching realm is used for validation. If no entry matches the realm, the last entry in the keytab is used. This process can be used to validate environments using cross-realm trust by placing the appropriate keytab entry as the last entry or the only entry in the keytab file.

Comment 9 errata-xmlrpc 2017-08-01 09:00:03 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:2294


Note You need to log in before you can comment on or make changes to this bug.