I've been working for 1 year with a configuration that allow us to use AD users with short names for login on RHEL 6 clients and also the information on the client was showed with shortnames. Example:

 

ssh AD_user@IDM_client1.mydomain.com

PASSWORD:

[AD_user@IDM_client1 ~]$ ls -la

total 60

drwxr-x---   5 AD_user AD_group 4096 Nov 21 08:53 .

drwxr-xr-x. 40 root      root     4096 Oct 29 09:12 ..

-rw-------   1 AD_user AD_group  281 Jul 27 00:13 .bash_history

-rw-r-----   1 AD_user AD_group   18 Oct  8  2015 .bash_logout

-rw-r-----   1 AD_user AD_group  176 Oct  8  2015 .bash_profile

-rw-r-----   1 AD_user AD_group  124 Oct  8  2015 .bashrc

[AD_user@IDM_client1 ~]$ id

uid=1156200001(AD_user) gid=1156200014(AD_group) groups=1156200014(AD_group),10001(AD_group2),20001(IDM_group1),1156200000(admins)...

 

My sssd configuration is (marked lines added for this configuration):

[domain/ipa.mydomain.com]

krb5_auth_timeout = 90

cache_credentials = True

krb5_store_password_if_offline = True

ipa_domain = ipa.mydomain.com

id_provider = ipa

auth_provider = ipa

access_provider = ipa

ldap_tls_cacert = /etc/ipa/ca.crt

ipa_hostname = IDM_client1.mydomain.com

chpass_provider = ipa

ipa_server = _srv_, IDM_server1.ipa.mydomain.com, IDM_server2.ipa.mydomain.com

dns_discovery_domain = ipa.mydomain.com

 

use_fully_qualified_names = true    <------------------------

subdomain_homedir=%o               

 

 

[sssd]

config_file_version = 2

services = nss, sudo, pam, ssh

domains = ipa.mydomain.com

 

default_domain_suffix = AD_domain.mydomain.com <------------------------

full_name_format = %1$s                 <------------------------

 

[nss]

filter_groups = root

filter_users = root,iccsecure,tomcat,oracle

reconnection_retries = 3

 

[pam]

reconnection_retries = 3

 

[sudo]

 

[ssh]

 

But I have realized that new RHEL 6 clients are not working like that anymore. Using the SAME configuration I can not login with short name (doesn't match HABC rule because don't show IDM_groups of the user, logs at the bottom). On the console I can see that my user (short name) just have the main group of the AD, all other groups have disappeared:

[AD_user@IDM_client2 ~]$ id

uid=1156200001(AD_user) gid=1156200014(AD_group) groups=1156200014(AD_group)

 

So I have commented the line on sssd.conf as workaround:

#full_name_format = %1$s

 

But now I have long names showed on the client server and it is very annoying:

[AD_user@IDM_client2 ~]$ ls -la

total 20

drwxr-x---  3 AD_user@AD_domain.mydomain.com AD_group@AD_domain.mydomain.com 4096 Nov 21 08:20 .

drwxr-xr-x 20 root                    root                     4096 Mar  6  2018 ..

-rw-------  1 AD_user@AD_domain.mydomain.com AD_group@AD_domain.mydomain.com  110 Nov 21 08:07 .bash_history

drwx------  2 AD_user@AD_domain.mydomain.com AD_group@AD_domain.mydomain.com 4096 Dec 14  2017 .ssh

-rw-------  1 AD_user@AD_domain.mydomain.com AD_group@AD_domain.mydomain.com  138 Nov 21 08:20 .Xauthority

 

On the servers were is working fine if I erased sssd cache and restarted sssd, then it has the problem.

So should be something that has change on the latests updates and we didn't realized because we were using the cache for login. And now that we have added new servers to IDM we have discovered the problem.

 

Can you please let me know how to configure nowadays sssd for having short names on the login for AD users and short names showed on the machine?

 

#### versions I'm using:#######

--- IDM SERVERS - RHEL 7.5:  ---

ipa-common-4.5.4-10.el7_5.4.4.noarch

ipa-python-compat-4.5.4-10.el7_5.4.4.noarch

ipa-server-4.5.4-10.el7_5.4.4.x86_64

ipa-server-common-4.5.4-10.el7_5.4.4.noarch

ipa-server-dns-4.5.4-10.el7_5.4.4.noarch

ipa-server-trust-ad-4.5.4-10.el7_5.4.4.x86_64

libipa_hbac-1.16.0-19.el7_5.8.x86_64

sssd-1.16.0-19.el7_5.8.x86_64

sssd-ad-1.16.0-19.el7_5.8.x86_64

sssd-client-1.16.0-19.el7_5.8.x86_64

sssd-common-1.16.0-19.el7_5.8.x86_64

sssd-common-pac-1.16.0-19.el7_5.8.x86_64

sssd-dbus-1.16.0-19.el7_5.8.x86_64

sssd-ipa-1.16.0-19.el7_5.8.x86_64

sssd-krb5-1.16.0-19.el7_5.8.x86_64

sssd-krb5-common-1.16.0-19.el7_5.8.x86_64

sssd-ldap-1.16.0-19.el7_5.8.x86_64

sssd-proxy-1.16.0-19.el7_5.8.x86_64

sssd-tools-1.16.0-19.el7_5.8.x86_64

 

--- IDM CLIENTS - RHEL 6.10: ---

ipa-admintools-3.0.0-51.el6.x86_64

ipa-client-3.0.0-51.el6.x86_64

ipa-python-3.0.0-51.el6.x86_64

libipa_hbac-1.13.3-60.el6.x86_64

python-iniparse-0.3.1-2.1.el6.noarch

python-libipa_hbac-1.13.3-60.el6.x86_64

python-sssdconfig-1.13.3-60.el6.noarch

sssd-1.13.3-60.el6.x86_64

sssd-ad-1.13.3-60.el6.x86_64

sssd-client-1.13.3-60.el6.x86_64

sssd-common-1.13.3-60.el6.x86_64

sssd-common-pac-1.13.3-60.el6.x86_64

sssd-ipa-1.13.3-60.el6.x86_64

sssd-krb5-1.13.3-60.el6.x86_64

sssd-krb5-common-1.13.3-60.el6.x86_64

sssd-ldap-1.13.3-60.el6.x86_64

sssd-proxy-1.13.3-60.el6.x86_64

sssd-tools-1.13.3-60.el6.x86_64

 

##### LOGS  #####

·         /var/log/sssd/sssd_ipa.mydomain.com.log (debug_level = 8):

[sssd[be[ipa.mydomain.com]]] [get_groups_dns] (0x0400): Root domain uses fully-qualified names, objects might not be correctly added to groups with short names.

[sssd[be[ipa.mydomain.com]]] [get_groups_dns] (0x0400): Root domain uses fully-qualified names, objects might not be correctly added to groups with short names.

[sssd[be[ipa.mydomain.com]]] [ipa_s2n_save_objects] (0x2000): Updating memberships for AD_user

[sssd[be[ipa.mydomain.com]]] [sysdb_mod_group_member] (0x0080): ldb_modify failed: [Attribute or value exists](20)[attribute 'member': value #0 on 'name=IDM_group1,cn=groups,cn=ipa.mydomain.com,cn=sysdb' already exists]

[sssd[be[ipa.mydomain.com]]] [sysdb_mod_group_member] (0x0400): Error: 17 (File exists)

[sssd[be[ipa.mydomain.com]]] [sysdb_update_members_ex] (0x0020): Could not add member [AD_user] to group [name=IDM_group1,cn=groups,cn=ipa.mydomain.com,cn=sysdb]. Skipping.

----- (repeated with all IDM_groups) -----

….

-----  the request -----

[sssd[be[ipa.mydomain.com]]] [be_pam_handler] (0x0100): Got request with the following data

[sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT

[sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): domain: AD_domain.mydomain.com

[sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): user: AD_user

[sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): service: sshd

[sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): tty: ssh

[sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): ruser:

[sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): rhost: 10.XX.XX.XX

[sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): authtok type: 0

[sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): newauthtok type: 0

[sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): priv: 1

[sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): cli_pid: 54232

[sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): logon name: not set

[sssd[be[ipa.mydomain.com]]] [sdap_access_send] (0x0400): Performing access check for user [AD_user]

[sssd[be[ipa.mydomain.com]]] [sdap_account_expired_rhds] (0x0400): Performing RHDS access check for user [AD_user]

----- result (doesn't find any group for the user) -----

[sssd[be[ipa.mydomain.com]]] [hbac_shost_attrs_to_rule] (0x0400): Processing source hosts for rule [All server access]

[sssd[be[ipa.mydomain.com]]] [hbac_shost_attrs_to_rule] (0x2000): Source hosts disabled, setting ALL

[sssd[be[ipa.mydomain.com]]] [hbac_eval_user_element] (0x1000): No groups for [AD_user]   <-----------------------------------------------

[sssd[be[ipa.mydomain.com]]] [ipa_hbac_evaluate_rules] (0x0080): Access denied by HBAC rules

[sssd[be[ipa.mydomain.com]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 6, <NULL>) [Success]

[sssd[be[ipa.mydomain.com]]] [be_pam_handler_callback] (0x0100): Sending result [6][AD_domain.mydomain.com]

[sssd[be[ipa.mydomain.com]]] [be_pam_handler_callback] (0x0100): Sent result [6][AD_domain.mydomain.com]

[sssd[be[ipa.mydomain.com]]] [sdap_process_result] (0x2000): Trace: sh[0xc4a3c0], connected[1], ops[(nil)], ldap[0xc4f480]

[sssd[be[ipa.mydomain.com]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!

[sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc60100/0xc5ccf0

[sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc60100/0xc61480

[sssd[be[ipa.mydomain.com]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching.

[sssd[be[ipa.mydomain.com]]] [be_client_destructor] (0x0400): Removed PAC client

[sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc4c890/0xc4b5e0

[sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc4c890/0xc4b4a0

[sssd[be[ipa.mydomain.com]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching.

[sssd[be[ipa.mydomain.com]]] [be_client_destructor] (0x0400): Removed SSH client

[sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc475d0/0xc45780

[sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc475d0/0xc45730

[sssd[be[ipa.mydomain.com]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching.

[sssd[be[ipa.mydomain.com]]] [be_client_destructor] (0x0400): Removed PAM client

[sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc4ed40/0xc4c9e0

[sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc4ed40/0xc4c990

[sssd[be[ipa.mydomain.com]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching.

[sssd[be[ipa.mydomain.com]]] [be_client_destructor] (0x0400): Removed SUDO client

[sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc42380/0xc3e080

[sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc42380/0xc21350

[sssd[be[ipa.mydomain.com]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kpasswdinfo.IPA.MYDOMAIN.ORG], [2][No such file or directory]

[sssd[be[ipa.mydomain.com]]] [be_ptask_destructor] (0x0400): Terminating periodic task [SUDO Smart Refresh]

[sssd[be[ipa.mydomain.com]]] [be_ptask_destructor] (0x0400): Terminating periodic task [SUDO Full Refresh]

[sssd[be[ipa.mydomain.com]]] [sdap_handle_release] (0x2000): Trace: sh[0xc4a3c0], connected[1], ops[(nil)], ldap[0xc4f480], destructor_lock[0], release_memory[0]

[sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc24320/0xc248e0

 

 

On the contrary on other IPA client without removing cache and same configuration it founds 13 groups:

[sssd[be[ipa.mydomain.com]]] [hbac_shost_attrs_to_rule] (0x0400): Processing source hosts for rule [All server access]

[sssd[be[ipa.mydomain.com]]] [hbac_shost_attrs_to_rule] (0x2000): Source hosts disabled, setting ALL

[sssd[be[ipa.mydomain.com]]] [hbac_eval_user_element] (0x1000): [13] groups for [AD_user]  <----------------------------------------------

[sssd[be[ipa.mydomain.com]]] [hbac_eval_user_element] (0x1000): Added group [IDM_group1] for user [AD_user]

------ 12 groups more ------

[sssd[be[ipa.mydomain.com]]] [ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule [Full ssh for admins]

[sssd[be[ipa.mydomain.com]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 0, <NULL>) [Success]

[sssd[be[ipa.mydomain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x1f72630], connected[1], ops[(nil)], ldap[0x1f75390]

[sssd[be[ipa.mydomain.com]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!

 

Thanks & Regards.