Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

For bugs related to Red Hat Enterprise Linux 5 product line. The current stable release is 5.10. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 678606

Summary:	User information not updated on login for secondary domains
Product:	Red Hat Enterprise Linux 5	Reporter:	Stephen Gallagher <sgallagh>
Component:	sssd	Assignee:	Stephen Gallagher <sgallagh>
Status:	CLOSED ERRATA	QA Contact:	Chandrasekar Kannan <ckannan>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	5.7	CC:	benl, dpal, grajaiya, jgalipea, kbanerje, prc
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	sssd-1.5.1-10.el5	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	678593	Environment:
Last Closed:	2011-07-21 08:09:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	678593
Bug Blocks:

Description Stephen Gallagher 2011-02-18 15:26:07 UTC

+++ This bug was initially created as a clone of Bug #678593 +++

Description of problem:
At any PAM action occurring online, SSSD is supposed to perform an initgroups() request to the backend to ensure that user and group memberships are accurate for the login. However, there is a bug identified in 1.5.1 where this lookup is not happening except on the first domain in the list.

Version-Release number of selected component (if applicable):
sssd-1.5.1-8.el5

How reproducible:
Every time

Steps to Reproduce:
1. Set up an SSSD configuration with two domains with debug_level = 4 or higher in the [pam] section
3. Log in as a user in the second domain
4. Examine /var/log/sssd/sssd_pam.log
  
Actual results:
Only domain1 is checked for user updates.

You will see debug message:
(Fri Feb 18 09:32:22 2011) [sssd[pam]] [pam_check_user_search] (4): Requesting info for [domain2user@domain1]
but not:
(Fri Feb 18 09:32:22 2011) [sssd[pam]] [pam_check_user_search] (4): Requesting info for [domain2user@domain2]

Expected results:
You should see debug messages:
(Fri Feb 18 09:32:22 2011) [sssd[pam]] [pam_check_user_search] (4): Requesting info for [domain2user@domain1]
(Fri Feb 18 09:32:22 2011) [sssd[pam]] [pam_check_user_search] (4): Requesting info for [domain2user@domain2]

Additional info:

Comment 3 Kaushik Banerjee 2011-05-25 14:07:14 UTC

Verified in version:
# rpm -qi sssd | head
Name        : sssd                         Relocations: (not relocatable)
Version     : 1.5.1                             Vendor: Red Hat, Inc.
Release     : 34.el5                        Build Date: Tue 03 May 2011 10:46:07 PM IST
Install Date: Tue 10 May 2011 01:20:13 AM IST      Build Host: x86-003.build.bos.redhat.com
Group       : Applications/System           Source RPM: sssd-1.5.1-34.el5.src.rpm
Size        : 3486753                          License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://fedorahosted.org/sssd/
Summary     : System Security Services Daemon

Comment 4 errata-xmlrpc 2011-07-21 08:09:17 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0975.html