I'm having trouble with group membership and one-way FreeIPA to AD trust. It seems IPA
does not update LDAP compat tree entry for a group when there are external users present.
Also it "getent group" sometimes shows outdated members list.
IPA master: ipa.idmlab.local, FreeIPA 4.5.0 on CentOS 7.4.1708
AD DC: ad.adlab.local, Windows Server 2012 R2 (W2K8 domain and forest functional level)
On the IPA there are a POSIX group named "posix-group", external group named
"external-group" and users named "ipauserX". On AD side there are
users with name starting with "aduser". "external-group" is a member
of "posix-group". Both groups are initially empty.
[root@ipa ~]# ipa group-show posix-group
Group name: posix-group
GID: 177000030
Member groups: external-group
[root@ipa ~]# ipa group-show external-group
Group name: external-group
Member of groups: posix-group
I add "ipauser1" to "posix-group" and everything works as expected.
[root@ipa ~]# ipa group-add-member posix-group --users=ipauser1
Group name: posix-group
GID: 177000030
Member users: ipauser1
Member groups: external-group
-------------------------
Number of members added 1
-------------------------
[root@ipa ~]# ipa group-show posix-group
Group name: posix-group
GID: 177000030
Member users: ipauser1
Member groups: external-group
[root@ipa ~]# ldapsearch -LLL -Y GSSAPI -b
'cn=groups,cn=compat,dc=idmlab,dc=local' '(cn=posix-group)' '*'
SASL/GSSAPI authentication started
SASL username: admin(a)IDMLAB.LOCAL
SASL SSF: 56
SASL data security layer installed.
dn: cn=posix-group,cn=groups,cn=compat,dc=idmlab,dc=local
objectClass: posixGroup
objectClass: ipaOverrideTarget
objectClass: ipaexternalgroup
objectClass: top
gidNumber: 177000030
memberUid: ipauser1
ipaAnchorUUID:: OklQQTppZG1sYWIubG9jYWw6ODJiOGE5ZjQtMDkyNC0xMWU4LThhNmItMDAwYz
I5MmYxZmFl
cn: posix-group
[root@ipa ~]# getent group posix-group
posix-group:*:177000030:ipauser1
Then I add "aduser1(a)adlab.local" to "external-group" and strange
things happen. Notice there are no "aduser1(a)adlab.local" in compat tree members
list.
[root@ipa ~]# ipa group-add-member external-group --external=aduser1(a)adlab.local
[member user]:
[member group]:
Group name: external-group
External member: S-1-5-21-669726201-3117635978-240273332-1604
Member of groups: posix-group
-------------------------
Number of members added 1
-------------------------
[root@ipa ~]# ipa group-show external-group
Group name: external-group
External member: aduser1(a)adlab.local
Member of groups: posix-group
[root@ipa ~]# ipa group-show posix-group
Group name: posix-group
GID: 177000030
Member users: ipauser1
Member groups: external-group
[root@ipa ~]# getent group posix-group
posix-group:*:177000030:ipauser1,aduser1@adlab.local
[root@ipa ~]# ldapsearch -LLL -Y GSSAPI -b
'cn=groups,cn=compat,dc=idmlab,dc=local' '(cn=posix-group)' '*'
SASL/GSSAPI authentication started
SASL username: admin(a)IDMLAB.LOCAL
SASL SSF: 56
SASL data security layer installed.
dn: cn=posix-group,cn=groups,cn=compat,dc=idmlab,dc=local
objectClass: posixGroup
objectClass: ipaOverrideTarget
objectClass: ipaexternalgroup
objectClass: top
gidNumber: 177000030
ipaAnchorUUID:: OklQQTppZG1sYWIubG9jYWw6ODJiOGE5ZjQtMDkyNC0xMWU4LThhNmItMDAwYz
I5MmYxZmFl
cn: posix-group
memberUid: ipauser1
Now if I add another user to "posix-group", compat tree gets updated but still
one step behind.
[root@ipa ~]# ipa group-add-member posix-group --users=ipauser2
Group name: posix-group
GID: 177000030
Member users: ipauser1, ipauser2
Member groups: external-group
-------------------------
Number of members added 1
-------------------------
[root@ipa ~]# ipa group-show posix-group
Group name: posix-group
GID: 177000030
Member users: ipauser1, ipauser2
Member groups: external-group
[root@ipa ~]# getent group posix-group
posix-group:*:177000030:ipauser1,ipauser2,aduser1@adlab.local
[root@ipa ~]# ldapsearch -LLL -Y GSSAPI -b
'cn=groups,cn=compat,dc=idmlab,dc=local' '(cn=posix-group)' '*'
SASL/GSSAPI authentication started
SASL username: admin(a)IDMLAB.LOCAL
SASL SSF: 56
SASL data security layer installed.
dn: cn=posix-group,cn=groups,cn=compat,dc=idmlab,dc=local
objectClass: posixGroup
objectClass: ipaOverrideTarget
objectClass: ipaexternalgroup
objectClass: top
gidNumber: 177000030
ipaAnchorUUID:: OklQQTppZG1sYWIubG9jYWw6ODJiOGE5ZjQtMDkyNC0xMWU4LThhNmItMDAwYz
I5MmYxZmFl
cn: posix-group
memberUid: ipauser1
memberUid: aduser1(a)adlab.local
Finally I remove "external-group" from "posix-group". This time compat
tree gets updated but getent still reports users from AD domain.
[root@ipa ~]# ipa group-remove-member posix-group --groups=external-group
Group name: posix-group
GID: 177000030
Member users: ipauser1, ipauser2
---------------------------
Number of members removed 1
---------------------------
[root@ipa ~]# getent group posix-group
posix-group:*:177000030:ipauser1,ipauser2,aduser1@adlab.local
[root@ipa ~]# ldapsearch -LLL -Y GSSAPI -b
'cn=groups,cn=compat,dc=idmlab,dc=local' '(cn=posix-group)' '*'
SASL/GSSAPI authentication started
SASL username: admin(a)IDMLAB.LOCAL
SASL SSF: 56
SASL data security layer installed.
dn: cn=posix-group,cn=groups,cn=compat,dc=idmlab,dc=local
objectClass: posixGroup
objectClass: ipaOverrideTarget
objectClass: ipaexternalgroup
objectClass: top
gidNumber: 177000030
memberUid: ipauser1
memberUid: ipauser2
ipaAnchorUUID:: OklQQTppZG1sYWIubG9jYWw6ODJiOGE5ZjQtMDkyNC0xMWU4LThhNmItMDAwYz
I5MmYxZmFl
cn: posix-group
And after I run id against AD user getent output gets updated.
[root@ipa ~]# getent group posix-group
posix-group:*:177000030:ipauser1,ipauser2,aduser1@adlab.local
[root@ipa ~]# id aduser1(a)adlab.local
uid=1679001604(aduser1(a)adlab.local) gid=1679001604(aduser1(a)adlab.local)
groups=1679001604(aduser1(a)adlab.local),1679000513(domain users(a)adlab.local)
[root@ipa ~]# getent group posix-group
posix-group:*:177000030:ipauser1,ipauser2
I've noticed some caching / data provider issues in sssd_nss.log.
(Sun Feb 4 02:41:15 2018) [sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data
Provider - DP error code: 1 errno: 11 error
message: Offline
(Sun Feb 4 02:41:15 2018) [sssd[nss]] [cache_req_common_dp_recv] (0x0040): CR #36: Data
Provider Error: 1, 11, Offline
(Sun Feb 4 02:41:15 2018) [sssd[nss]] [cache_req_common_dp_recv] (0x0400): CR #36: Due to
an error we will return cached data
(Sun Feb 4 02:41:15 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #36: Looking
up [ID:177000030@idmlab.local] in cache
Would be grateful for help in resolving this issue!