Description of problem: Cannot map overridden primary group id of the user with private user group back to group name. Version-Release number of selected component (if applicable): ipa-client-common-4.10.1-7.el9_2.noarch ipa-selinux-4.10.1-7.el9_2.noarch ipa-common-4.10.1-7.el9_2.noarch ipa-client-4.10.1-7.el9_2.x86_64 How reproducible: Always Steps to Reproduce: Create user override for a system which needs it: vesemir:~> ipa idview-add TEST -------------------- Added ID View "TEST" -------------------- ID View Name: TEST vesemir:~> ipa idoverrideuser-add TEST tomek --uid=18519 --gidnumber=18519 ------------------------------ Added User ID override "tomek" ------------------------------ Anchor to override: tomek UID: 18519 GID: 18519 vesemir:~> ipa idview-apply TEST --hosts=paulie ---------------------- Applied ID View "TEST" ---------------------- hosts: paulie --------------------------------------------- Number of hosts the ID View was applied to: 1 --------------------------------------------- Give some time to propagate the change to all replicas. Clean sssd cache on paulie and restart it. Now ssh to paulie: vesemir:~> ssh paulie.XXXXX.org Last login: Thu Jul 13 21:01:26 2023 from 2a0X:XXXX:XXXX:3000:94cb:2ef5:6321:e82f [tomek@paulie ~]$ id uid=18519(tomek) gid=18519 grupy=18519,20000000 kontekst=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [tomek@paulie ~]$ getent passwd tomek tomek:*:18519:18519:Tomasz KXXXXXXXXi:/home/tomek:/bin/bash [tomek@paulie ~]$ getent group tomek tomek:*:20000003: [tomek@paulie ~]$ getent passwd 18519 tomek:*:18519:18519:Tomasz KXXXXXXXXi:/home/tomek:/bin/bash [tomek@paulie ~]$ getent group 18519 [tomek@paulie ~]$ As seen above: - user tomek has primary group id of 18519 - overridden - but it is NOT resolvable back to group name - additional note - 20000000 is gid for group admins and it is NOT resolved (this might be a separate bug as it was NOT overridden) Try to override tomek group: vesemir:~> ipa idoverridegroup-add TEST tomek --gid=18519 ipa: ERROR: invalid 'IPA object': system IPA objects (e.g. system groups, user private groups) cannot be overridden Actual results: Cannot override user's private user group. Expected results: User can keep private user group override AND that group CAN be overridden as necessary. Additional info: 3 replicas in the domain, 2 - on AlmaLinux 9.2, 1 - on AlmaLinux 8.8. All involved clients - on AlmaLinux 9.2.
Re-assigning the product for analysis. SSSD handles the implementation of the overrides.