Bug 982619

Can you try changing sssd.conf to:

simple_allow_groups = test permit group

Could you try this command:

$ realm permit --realm=security.baseos.qe --groups 'test permit group'

Result is the same.

[test]realm permit --realm=security.baseos.qe --groups 'test permit group'

[test]realm list
security.baseos.qe
  type: kerberos
  realm-name: SECURITY.BASEOS.QE
  domain-name: security.baseos.qe
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common
  login-formats: %U.qe
  login-policy: allow-permitted-logins
  permitted-logins: 
  permitted-groups: test permit group


[test]cat /etc/sssd/sssd.conf 
[sssd]
config_file_version = 2
domains = LDAP, security.baseos.qe
services            = nss, pam, sudo

[nss]
filter_groups       = root
filter_users        = root
default_shell = /bin/bash

[pam]

[sudo]
debug_level         = 0xFFFF

[domain/LDAP]
id_provider         = ldap
auth_provider       = ldap
sudo_provider       = ldap
debug_level         = 0xFFFF
ldap_uri            = ldap://example.com
ldap_tls_cacert     = /etc/openldap/certs/cacert.asc
ldap_search_base    = dc=example,dc=com
entry_cache_nowait_percentage       = 0
entry_cache_timeout                 = 0
ldap_sudo_smart_refresh_interval    = 1
ldap_sudo_full_refresh_interval     = 10

[domain/security.baseos.qe]
ad_domain = security.baseos.qe
krb5_realm = SECURITY.BASEOS.QE
realmd_tags = manages-system
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
access_provider = simple
krb5_use_enterprise_principal=False
simple_allow_groups = test permit groupf 


[test]ssh amy.qe@localhost
amy.qe@localhost's password: 
Connection closed by ::1

(In reply to David Spurek from comment #2)
> simple_allow_groups = test permit groupf 

This looks wrong. Could you correct this, restart sssd, and try again?

Sorry, this was copy/paste typo.
Current line with this variable is 'simple_allow_groups = test permit group'

I try getent - getent group 'test permit group' and it shows me nothing, maybe this is a problem with this setup.

Very odd. This looks like an sssd bug in that case. If sssd is not respecting 'simple_allow_groups = test permit group' then that sounds like a bug.

Tried with modified realmd.conf, getents without fqdn now works, but result is the same.

[test]cat /etc/realmd.conf 
[security.baseos.qe]
fully-qualified-names = no

[test]getent passwd amy
amy:*:89801125:89800513:Amy:/home/security.baseos.qe/amy:/bin/bash
[test]getent group 'test permit group'
test permit group:*:89801530:amy

[test]realm permit --realm=security.baseos.qe --groups 'test permit group'

[test]realm list
security.baseos.qe
  type: kerberos
  realm-name: SECURITY.BASEOS.QE
  domain-name: security.baseos.qe
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common
  login-formats: %U.qe
  login-policy: allow-permitted-logins
  permitted-logins: 
  permitted-groups: test permit group

[test]cat /etc/sssd/sssd.conf 
[sssd]
config_file_version = 2
services            = nss, pam
domains = security.baseos.qe

[nss]
filter_groups       = root
filter_users        = root
default_shell = /bin/bash

[pam]

[sudo]

[domain/security.baseos.qe]
ad_domain = security.baseos.qe
krb5_realm = SECURITY.BASEOS.QE
realmd_tags = manages-system
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%d/%u
access_provider = simple
simple_allow_groups = test permit group
krb5_use_enterprise_principal=False

[test]ssh amy@localhost
amy@localhost's password: 
Connection closed by ::1

Hi, do you have this environment set up somewhere? I tried to reproduce but couldn't..

Upstream ticket:
https://fedorahosted.org/sssd/ticket/2026

Hi,
unfortunately, SSSD is not able to parse fqdn in simple_allow_groups and similar options. Only group name alone is accepted.

I've tried it, even vm provided by David with those results:

use_fully_qualified_names = True
simple_allow_groups = test permit group.qe
==> amy is not permitted to log in

use_fully_qualified_names = True
simple_allow_groups = test permit group
==> amy is allowed to log in

We should parse the name for domain name and accept both formats.

Cleaning needinfo flag, environment was prepared.

Is this really a rhel-7.0.0 blocker? I think the upstream fix targets a later release.

(In reply to Stef Walter from comment #11)
> Is this really a rhel-7.0.0 blocker? I think the upstream fix targets a
> later release.

There are two upstream issues. One is to be able to parse fully qualified names in the simple access provider at all. This one we have a patch for and is quite easy.

The other more involved fix is to be able to dynamically discover a trusted domain that might be part of the FQDN but not known during the startup. This requires more changes as the code as one provider (of type simple) might need to call another provider (of different type) to validate the domain:
https://fedorahosted.org/sssd/ticket/2034

(In reply to Stef Walter from comment #11)
> Is this really a rhel-7.0.0 blocker? I think the upstream fix targets a
> later release.

It is a question. I don't think this is really important feature but on the other hand it is documented in man page so supposed to work.

@ Jakub, when is it planned to be fixed?

(In reply to Patrik Kis from comment #13)
> (In reply to Stef Walter from comment #11)
> > Is this really a rhel-7.0.0 blocker? I think the upstream fix targets a
> > later release.
> 
> It is a question. I don't think this is really important feature but on the
> other hand it is documented in man page so supposed to work.
> 
> @ Jakub, when is it planned to be fixed?

We have a patch on the mailing list already, the fix is going to RHEL-7.0.

I think this is a pretty important feature actually given that realmd uses fully qualified names by default.

Temporarily moving bugs to MODIFIED to work around errata tool bug

Verified in version

Output from beaker automation run:
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: ad_forest_simple_007: bz 982619 simple_deny_groups=group1
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Running 'su_success user1_dom1 Secret123' (Expected 0, got 0)
:: [   PASS   ] :: Running 'su_permission_denied user1_dom2 Secret123' (Expected 0, got 0)
:: [   PASS   ] :: Running 'su_permission_denied user1_dom3.com Secret123' (Expected 0, got 0)
:: [   LOG    ] :: Duration: 9s
:: [   LOG    ] :: Assertions: 3 good, 0 bad
:: [   PASS   ] :: RESULT: ad_forest_simple_007: bz 982619 simple_deny_groups=group1

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Stef Walter, the following command did work for me.. thanks

I denied all a realm access and wanted to just open up for few Active Directory groups.

realm permit --realm=<FQDN Domain> --groups 'group name'

Thanks,
Dinesh