On to, 28 tammi 2021, Ronald Wimmer via FreeIPA-users wrote:
>>> GID: 63
>>>[root@master ~]# ipa group-add-member audio --users testuser
>>> Group name: audio
>>> GID: 63
>>> Member users: testuser
>>>-------------------------
>>>Number of members added 1
>>>-------------------------
>>>[root@master ~]# getent initgroups testuser
>>>testuser 63
>>>[root@master ~]#
>>>
>>>Now, if I'd add 'testuser' to 'video' group in /etc/group,
'video' will
>>>be in the list of groups 'testuser' is a member of:
>>>
>>>[root@master ~]# fgrep testuser /etc/group
>>>video:x:39:testuser
>>>[root@master ~]# getent initgroups testuser
>>>testuser 63 39
>>>
>>>This is on RHEL 8.
>>
>>On my server (Oracle Linux 8.3) fgrep
>>/etc/authselect/user-nsswitch.conf returns nothing.
>>
>>What I did:
>>- Added "initgroups: sss [SUCCESS=merge] files" as first line in
>>/etc/nsswitch.conf
>>- Create icinga(a)linux.mydomain.at user in IPA
>>- usermod -a -G docker icinga(a)linux.mydomain.at
>>
>>getent initgroups icinga(a)linux.mydomain.at returns just the user name.
>>
>>So it seems not to work. Or am I missing something?
>
>Can you test it without the domain suffix? E.g. non-fully qualified. May
>be this is causing some issues? -- / Alexander Bokovoy
getent initgroups does return just the user name in either case.
Sorry, I have no Oracle Linux 8.3 at hand. It works for me on RHEL and
Fedora so I know this is working at least with glibc 2.28 in RHEL 8 and
default FreeIPA deployment options.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland