I've tried the same setup with RHEL 7.5 beta and Fedora Server 27 but still no luck.
Everything works fine (except there is no membership info for AD users in
cn=groups,cn=compat) until I add the following lines to the compat plugin configuration in
LDAP:
schema-compat-entry-attribute:
ipaexternalmember=%deref_r("member","ipaexternalmember")
schema-compat-entry-attribute: objectclass=ipaexternalgroup
After that I get wierd behavior such as membership info in cn=groups,cn=compat does not
update at all or shows outdated information. It also takes significantly longer to add or
remove members from groups.
I've uploaded SSSD logs with debug_level=10 to
https://drive.google.com/open?id=1DzJ5csjmxcLonwyYS_JGoQ2wFRbiPKiw for the following
command sequence (rebooted the server, cleared SSSD cache and logs before that):
shell> ipa group-add-member external-group --external=aduser1(a)adlab.local
shell> ldapsearch -Y GSSAPI -b 'cn=groups,cn=compat,dc=idmlab,dc=local'
'(cn=posix-group)'
shell> ipa group-add-member external-group --external=aduser4(a)adlab.local
shell> ldapsearch -Y GSSAPI -b 'cn=groups,cn=compat,dc=idmlab,dc=local'
'(cn=posix-group)'
shell> ipa group-add-member external-group --external=aduser4(a)adlab.local
shell> ldapsearch -Y GSSAPI -b 'cn=groups,cn=compat,dc=idmlab,dc=local'
'(cn=posix-group)'
Also the very first attempt to add aduser4 failed with "member group:
aduser4(a)adlab.local: trusted domain object not found" while the second one a few
seconds later succeeded. It also seems that "ipa group-add-member" returns
correct membership info (at least for external users) in its output.
Am I missing something very important here or is it another bug?
--
Boris Sukhinin