Bug 1393730
| Summary: | No supplementary groups are resolved for users in nested OUs when domain stanza differs from AD domain | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Marcel Kolaja <mkolaja> |
| Component: | sssd | Assignee: | SSSD Maintainers <sssd-maint> |
| Status: | CLOSED ERRATA | QA Contact: | Steeve Goveas <sgoveas> |
| Severity: | unspecified | Docs Contact: | Marc Muehlfeld <mmuehlfe> |
| Priority: | high | ||
| Version: | 7.3 | CC: | dlavu, enewland, grajaiya, jhrozek, lslebodn, mkolaja, mkosek, mzidek, pbrezina, sgoveas, sssd-maint, tlavigne, tscherf |
| Target Milestone: | rc | Keywords: | ZStream |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | sssd-1.14.0-43.el7_3.7 | Doc Type: | Bug Fix |
| Doc Text: |
Previously, the System Security Services Daemon (SSSD) only used the domain name set in the /etc/sssd/sssd.conf file to match found entries if multiple entries matched the search result. Consequently, if two users with the same sAMAccountName attribute were present in two nested Active Directory (AD) domains and the domain name set in the /etc/sssd/sssd.conf file was different than the AD domain name, SSSD failed to resolve supplementary groups for these accounts. SSSD now uses the domain name set in the configuration file and additionally the remote domain name. As a result, secondary groups are now resolved correctly.
|
Story Points: | --- |
| Clone Of: | 1378911 | Environment: | |
| Last Closed: | 2017-01-17 18:09:52 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1378911 | ||
| Bug Blocks: | |||
|
Description
Marcel Kolaja
2016-11-10 08:51:26 UTC
Verified against sssd-1.14.0-43.el7_3.4.x86_64 :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: idmap_014: bz874616 Silence DEBUG messages when dealing with built-in SIDs :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ BEGIN ] :: Running 'id Administrator' uid=1196000500(administrator) gid=1196000513(domain users) groups=1196000513(domain users),1196000512(domain admins),1196000518(schema admins),1196000520(group policy creator owners),1196000572(denied rodc password replication group),1196000519(enterprise admins) :: [ PASS ] :: Command 'id Administrator' (Expected 0, got 0) :: [ PASS ] :: File '/var/log/sssd/sssd_ADTEST.log' should contain 'Object SID \[S-1-5-32-545\] is a built-in one' :: [ PASS ] :: File '/var/log/sssd/sssd_ADTEST.log' should contain 'Object SID \[S-1-5-32-544\] is a built-in one' :: [ PASS ] :: File '/var/log/sssd/sssd_ADTEST.log' should contain 'Skipping built-in object' :: [ PASS ] :: File '/var/log/sssd/sssd_ADTEST.log' should not contain 'Could not parse domain SID' :: [ PASS ] :: File '/var/log/sssd/sssd_ADTEST.log' should not contain 'Could not convert SID to GID' Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2017-0078.html |