Hide Forgot
+++ This bug was initially created as a clone of Bug #691678 +++ With sssd-1.5.1-15.el6.0.1.x86_64: 1. This is solved: When I use enumerate true in sssd.conf I see groups returned with 'id DOMAINUSER' that are not defined as Linux groups. 2. This is solved: Also 'getent group GROUPNAME' works for groups that are not defined as Linux Groups(no GID on domain level) 3. This is solved when added per your advice ldap_user_gecos = cn into sssd.conf 'getent passwd DOMAINUSER' doesn't show username as it used to only empty space 4. SSSD not showing group membership when account not added as group member under Unix Attributes on AD This is still keeping me from switching to sssd since I would have to check hundreds of groups and add memberships. Right now I would like to keep this setup: 1. I create domain local group in AD domainlocalgroup 2. Add NIS Domain and GID on UNIX Attributes tab in Active Directory Users and Computers for domainlocalgroup 3. Create domain global group in AD as a member of domainlocalgroup : domainglobal 4. Add user members to domainglobal group that are defined in AD as a Linux Users linuxuser1 linuxuser2 with above setup on old configuration I get [root@localhost ~]$ getent group |grep -i domainlocalgroup domainlocalgroup:*:10045:linuxuser1,linuxuser2 and on new sssd configuration: [root@localhost ~]# getent group |grep -i domainlocalgroup domainlocalgroup:*:10045: so it looks that there is some problem with nested groups This setup allows us to limit number of groups returned with 'getent group' as we have to only define Unix Attributes for the first group and users and not to all the groups below. With complicated membership setup I think that would be a great advantage.
We need some more information to understand what's going on here. SSSD *should* be handling this correctly already. Can you please include in the ticket the (sanitized) LDAP contents for domainlocalgroup, domainglobal and linuxuser1? I want to see what attributes are set there, most notably the 'member', 'memberOf', 'memberuid' and gidNumber attributes for the groups, as well as the 'uid', 'uidNumber', 'gidNumber' and 'memberOf' attributes for the users. Also, a listing of the objectClasses in use for both types would be very helpful.
Oh, and we'd also like for you to turn on debugging and send us the debug logs. You can do this by setting 'debug_level = 9' in the [domain/AD] section of sssd.conf and restarting the SSSD ('service sssd restart' as root). Then attempt your request as described in this ticket, note the time that you perform this request and then attach /var/log/sssd/sssd_AD.log to this Bugzilla ticket. (If you have company-sensitive information such as the domain name, please feel free to sanitize it). This debug log will give us a lot of information to follow the code path and to see where errors may be ocurring.
Created attachment 488765 [details] AD group memberships and configuration
this is what I get with old configuration: [root@localhost ~]# id linuxuser1 uid=10000(linuxuser1) gid=10001(Linux_Users) groups=10001(Linux_Users),10045(domainlocalgroup) domainglobal is not Unix Group [root@localhost ~]# getent group domainlocalgroup domainlocalgroup:*:10045:linuxuser1,linuxuser2 and this is what I get with sssd: [root@localhost ~]# id linuxuser1 uid=10000(linuxuser1) gid=10001(Linux_Users) groups=10001(Linux_Users) domainglobal is not Unix Group [root@localhost ~]# getent group domainlocalgroup domainlocalgroup:*:10045: about attached images: 1.jpg = domainlocalgroup memberof 2.jpg = domainlocalgroup unix attributes 3.jpg = domainglobal members 4.jpg = domainglobal unix attributes 5.jpg = domainglobal membersof 6.jpg = linuxuser1 unix attributes will attach logs soon
(In reply to comment #3) > Created attachment 488765 [details] > AD group memberships and configuration Those screenshots aren't terribly useful. I need to see the actual LDAP contents. This can be found by doing (from Linux): ldapsearch -x -H ldap://ldap.example.com -b dc=example,dc=com \ -D CN=List,OU=General,OU=Users,DC=example,DC=com -W \ "(uid=linuxuser1)" Substitute "(cn=domainlocalgroup)" in the last part to get the attributes for the groups.
Ok, I think I understand the hierarchy here now. Sorry for the confusion. So you have two users which have UNIX attributes, linuxuser1 and linuxuser2. These users are members of a group called domainglobal, which is NOT configured for use with UNIX. The group domainglobal is a nested member of the group domainlocalgroup which DOES have UNIX configuration. So the bug as you see it is that lookups for domainlocalgroup should return linuxuser1 and linuxuser2 as members. And in reverse, a lookup of the groups for linuxuser1 and linuxuser2 should list domainlocalgroup. Ok, so this is a known limitation of the SSSD at this time. The problem is that the way we do caching right now requires that all entries in the nesting chain must have complete UNIX attributes. Otherwise our caching routines throw an error (this is to guarantee that all lookups maintain their integrity). I've opened a ticket upstream (https://fedorahosted.org/sssd/ticket/833) to track this request. It will be a significant effort, and so I'm moving the proposed inclusion out to RHEL 6.2.
Thanks for update. You are right about the configuration I have. Do you have any knowledge about when 6.1 and 6.2 are planned to be released ?
I can't make any specific statements about release schedules. I will, however, note that 6.1 beta was released five days ago, so that should give you a decent indication as to when 6.1 is due.
Verified in version: # rpm -qi sssd | head Name : sssd Relocations: (not relocatable) Version : 1.5.1 Vendor: Red Hat, Inc. Release : 52.el6 Build Date: Tue 20 Sep 2011 09:11:03 PM IST Install Date: Mon 26 Sep 2011 05:56:30 PM IST Build Host: x86-010.build.bos.redhat.com Group : Applications/System Source RPM: sssd-1.5.1-52.el6.src.rpm Size : 3550647 License: GPLv3+ Signature : (none) Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla> URL : http://fedorahosted.org/sssd/ Summary : System Security Services Daemon
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Cause: SSSD required that all groups it worked with had a complete set of UNIX attributes. However, Active Directory groups can be individually set with or without UNIX attributes. When a group without UNIX attributes had a member that did have UNIX attributes, SSSD would not have recursed to the nested UNIX group Consequence: SSSD was unable to traverse the hierarchy correctly and the initgroups() operation did not return all groups correctly Fix: SSSD was changed so it can examine non-UNIX groups for potential UNIX nested member groups Result: SSSD is able to traverse the hierarchy correctly and return the complete list of groups even if the hierarchy mixes UNIX and non-UNIX groups
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1529.html