The right HBAC is called allow_ad_ipa_admins, that match the IPA group ad_ipa_admins, that is trusted with the group 'IPA Admins' in Active Directory.
I tested the id morgan.marodin@mydomain.com command both in the client and the server, they differ only for the last part ,219402407(ad_ipa_admins).
I can see it in the client, not in the server.

But the same client, as said last time, sometimes works correctly, please see these logs captured doing a SSH connection with the AD credential, after cleaning manually the sssd cache of the client:
[root@mlv-testipa01 ~]# systemctl stop sssd ; rm -rf /var/lib/sss/db/* ; systemctl start sssd
[root@mlv-testipa01 ~]# tail -f /var/log/sssd/*log | grep -i allow
(Mon Feb 25 15:35:41 2019) [sssd[be[ipa.mydomain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginAllowedTimeMap]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [ipa_hbac_rule_info_next] (0x0400): Sending request for next search base: [cn=hbac,dc=ipa,dc=mydomain,dc=com][2][(&(objectclass=ipaHBACRule)(ipaenabledflag=TRUE)(accessRuleType=allow)(|(hostCategory=all)(memberHost=fqdn=mlv-testipa01.ipa.mydomain.com,cn=computers,cn=accounts,dc=ipa,dc=mydomain,dc=com)))]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectclass=ipaHBACRule)(ipaenabledflag=TRUE)(accessRuleType=allow)(|(hostCategory=all)(memberHost=fqdn=mlv-testipa01.ipa.mydomain.com,cn=computers,cn=accounts,dc=ipa,dc=mydomain,dc=com)))][cn=hbac,dc=ipa,dc=mydomain,dc=com].
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_attrs_to_rule] (0x1000): Processing rule [allow_ipa_it_mysite]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_user_attrs_to_rule] (0x1000): Processing users for rule [allow_ipa_it_mysite]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_user_attrs_to_rule] (0x2000): Added non-POSIX group [ipa_it_mysite] to rule [allow_ipa_it_mysite]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_service_attrs_to_rule] (0x1000): Processing PAM services for rule [allo _ipa_it_mysite]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_thost_attrs_to_rule] (0x1000): Processing target hosts for rule [allow_ipa_it_mysite]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_shost_attrs_to_rule] (0x0400): Processing source hosts for rule [allow_ipa_it_mysite]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_attrs_to_rule] (0x1000): Processing rule [allow_ad_ipa_admins]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_user_attrs_to_rule] (0x1000): Processing users for rule [allow_ad_ipa_admins]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_user_attrs_to_rule] (0x2000): Added POSIX group [ad_ipa_admins@ipa.mydomain.com] to rule [allow_ad_ipa_admins]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_service_attrs_to_rule] (0x1000): Processing PAM services for rule [allo _ad_ipa_admins]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_thost_attrs_to_rule] (0x1000): Processing target hosts for rule [allow_ad_ipa_admins]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_shost_attrs_to_rule] (0x0400): Processing source hosts for rule [allow_ad_ipa_admins]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_attrs_to_rule] (0x1000): Processing rule [allow_bexec]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_user_attrs_to_rule] (0x1000): Processing users for rule [allow_bexec]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_service_attrs_to_rule] (0x1000): Processing PAM services for rule [allo _bexec]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_service_attrs_to_rule] (0x2000): Added service [sshd] to rule [allow_bexec]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_thost_attrs_to_rule] (0x1000): Processing target hosts for rule [allow_bexec]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_shost_attrs_to_rule] (0x0400): Processing source hosts for rule [allow_bexec]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_debug_print] (0x2000):     RULE [allow_ipa_it_mysite] [ENABLED]:
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_evaluate] (0x0100): The rule [allow_ipa_it_mysite] did not match.
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_debug_print] (0x2000):     RULE [allow_ad_ipa_admins] [ENABLED]:
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_evaluate] (0x0100): ALLOWED by rule [allow_ad_ipa_admins].
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule [allow_ad_ipa_admins]
(Mon Feb 25 15:36:23 2019) [sssd[be[ipa.mydomain.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginAllowedTimeMap]


So it's a strange behaviour because sometimes it worked and sometimes not.
Which logs shoul be useful now?

Please let me know, thanks

Il giorno lun 25 feb 2019 alle ore 09:45 Sumit Bose <sbose@redhat.com> ha scritto:
On Mon, Feb 25, 2019 at 09:02:30AM +0100, Morgan Marodin wrote:
>  No, it's not true. It's random ... it not depends (maybe) from the server.
> You can find attached the debug logs from the test client, thanks

Hi,

at the end of the logs you can see the evaluation of the HBAC rules:

(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_evaluate] (0x0100): [< hbac_evaluate()
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_req_debug_print] (0x2000):      REQUEST:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print] (0x2000):          service [sshd]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print] (0x2000):          service_group (none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print] (0x2000):          user [morgan.marodin]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print] (0x2000):          user_group (none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print] (0x2000):          targethost [mlv-testipa01.ipa.mydomain.com]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print] (0x2000):          targethost_group (none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print] (0x2000):          srchost [192.168.100.252]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print] (0x2000):          srchost_group (none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_req_debug_print] (0x2000):              request time 2019-02-21 16:04:23
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_debug_print] (0x2000):     RULE [allow_ipa_it_mysite] [ENABLED]:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_debug_print] (0x2000):     services:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_element_debug_print] (0x2000):             category [0x1] [ALL]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_debug_print] (0x2000):     users:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_element_debug_print] (0x2000):             category [0] [NONE]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_element_debug_print] (0x2000):             users_names (none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_element_debug_print] (0x2000):             users_groups:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_element_debug_print] (0x2000):                     [ipa_it_mysite]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_debug_print] (0x2000):     targethosts:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_element_debug_print] (0x2000):             category [0x1] [ALL]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_debug_print] (0x2000):     srchosts:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_rule_element_debug_print] (0x2000):             category [0x1] [ALL]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_evaluate] (0x0100): The rule [allow_ipa_it_mysite] did not match.

......

The allow_ipa_it_mysite and all other rules do not match because

(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_request_element_debug_print] (0x2000):          user_group (none)

Earlier in the logs, when the group memberships of the user are looked up:

(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400): Received [7] groups in group list from IPA Server
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400): [morgan.marodin@mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400): [local proxy exclusion@mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400): [mysite signature@mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400): [mysite users@mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400): [ipa admins@mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400): [mysite it@mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]] [ipa_s2n_get_user_done] (0x0400): [domain users@mydomain.com].

there are only groups from the AD domain and the IPA group memberships are
missing.

I would expect that 'id morgan.marodin@mydomain.com' only returns the groups
listed above both on the client and on the server. Since the client gets the
group-memberships from the server the next step would be to check the server
logs.

For this please call 'sss_cache -E' on the server to invalidate the cache on
the server and then 'id morgan.marodin@mydomain.com' on the server and send the
logs covering the time of the id request. Please do not forget to set
debug_level=9 in the [nss] and [domain/...] sections on the IPA server.

bye,
Sumit


>
> Il giorno gio 21 feb 2019 alle ore 16:01 Sumit Bose via FreeIPA-users <
> freeipa-users@lists.fedorahosted.org> ha scritto:
>
> > On Thu, Feb 21, 2019 at 03:47:15PM +0100, Morgan Marodin via FreeIPA-users
> > wrote:
> > > I did some tests, because some times SSH logins worked ... and sometimes
> > > not.
> > >
> > > It seems that the problem is not client side:
> > > - if I stop the 1st IPA server I'm able to login via SSH via AD
> > credentials
> > > - if I stop the 2nd one (after started the other one, naturally) the
> > issue
> > > appears again
> > >
> > > With only the issued server started the I'm able to do a *kinit*
> > correctly.
> > > What could I check server side?
> >
> > I think it would be better to check the SSSD logs on the client side.
> > Please add debug_level=9 to the [pam] and [domain/...] sections of
> > sssd.conf, restart SSSD and retry the login with only the 1st server
> > running to reproduce the issue.
> >
> > According to the log snippet you send earlier, it is expected that kinit
> > works fine because the authentication step 'pam_sss(sshd:auth)' was
> > successful. This is the step which does a similar operation as kinit.
> > The failure was in the next step 'pam_sss(sshd:access)' which is access
> > control.
> >
> > bye,
> > Sumit
> >
> > >
> > > Please let me know, thanks.
> > > Morgan
> > >
> > > Il giorno mar 19 feb 2019 alle ore 19:57 Sumit Bose via FreeIPA-users <
> > > freeipa-users@lists.fedorahosted.org> ha scritto:
> > >
> > > > On Tue, Feb 19, 2019 at 06:19:18PM +0100, Morgan Marodin via
> > FreeIPA-users
> > > > wrote:
> > > > > Hi everybody.
> > > > >
> > > > > I have just upgraded my cluster from FreeIPA 4.4.0-14 to 4.6.4-10.
> > > > > All is good, logging via IPA credentials, HBAC and sudo rules are
> > > > working.
> > > > > I have only a issue logging via SSH with AD credentials. Before the
> > > > upgrade
> > > > > all was working well.
> > > > >
> > > > > I think that the trust is ok, because *kinit*, *ipa hbactest* and
> > *ipa
> > > > > trustdomain-find* (on both ipa servers) are working well:
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > *[root@mlv-ipasrv01 ~]# ipa trustdomain-find MYDOMAIN.COM
> > > > > <http://MYDOMAIN.COM>  Domain name: mydomain.com <
> > http://mydomain.com>
> > > > > Domain NetBIOS name: MYDOMAIN  Domain Security Identifier:
> > > > > S-1-5-21-3367759252-2451474351-126822339  Domain enabled:
> > > > > True----------------------------Number of entries returned
> > > > > 1----------------------------[root@mlv-ipasrv01 ~]# ipa hbactest
> > > > > --user=morgan.marodin@mydomain.com <morgan.marodin@mydomain.com>
> > > > > --host=mlv-testipa01.ipa.mydomain.com
> > > > > <http://mlv-testipa01.ipa.mydomain.com>Service:
> > > > > sshd--------------------Access granted: True--------------------
> > Matched
> > > > > rules: allow_ad_ipa_admins  Not matched rules: allow_ad_ipa_apps  Not
> > > > > matched rules: allow_ipa_it_mysite[root@mlv-testipa01 ~]# kinit
> > > > > morgan.marodin@mydomain.com <morgan.marodin@mydomain.com>Password
> > for
> > > > > morgan.marodin@mydomain.com
> > > > > <morgan.marodin@mydomain.com>:[root@mlv-testipa01 ~]# klistTicket
> > cache:
> > > > > KEYRING:persistent:0:0Default principal: morgan.marodin@MYDOMAIN.COM
> > > > > <morgan.marodin@MYDOMAIN.COM>Valid starting       Expires
> > > > > Service principal02/19/2019 17:55:23  02/20/2019 03:55:23
> > > > > krbtgt/MYDOMAIN.COM@MYDOMAIN.COM <MYDOMAIN.COM@MYDOMAIN.COM>
> > > > renew
> > > > > until 02/20/2019 17:55:18*
> > > > >
> > > > > This is the error log:
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > *[root@mlv-testipa01 ~]# tail -f /var/log/secureFeb 19 18:03:21
> > > > > mlv-testipa01 sshd[378408]: pam_sss(sshd:auth): authentication
> > success;
> > > > > logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.252
> > > > > user=morgan.marodin@mydomain.com <morgan.marodin@mydomain.com>Feb 19
> > > > > 18:03:21 mlv-testipa01 sshd[378408]: pam_sss(sshd:account): Access
> > denied
> > > > > for user morgan.marodin@mydomain.com <morgan.marodin@mydomain.com>:
> > 6
> > > > > (Permission denied)
> > > >
> > > > This is returned by SSSD, please add debug_level=9 to the [domain/...]
> > > > section of sssd.conf, restart, SSSD and try to login again. In the
> > > > domain log you should find the evaluation of the HBAC rules which might
> > > > explain why access was denied.
> > > >
> > > > > Feb 19 18:03:21 mlv-testipa01 sshd[378401]: error: PAM:
> > > > > User account has expired for morgan.marodin@mydomain.com
> > > > > <morgan.marodin@mydomain.com> from 192.168.100.252
> > > >
> > > > I'm not sure where this message comes from. I had a short look at the
> > > > ssh and PAM source code, but so far didn't find a matching messages.
> > > >
> > > > bye,
> > > > Sumit
> > > >
> > > > > Feb 19 18:03:21
> > > > > mlv-testipa01 sshd[378401]: fatal: monitor_read: unpermitted request
> > 104*
> > > > >
> > > > > It seems a problem with pam and sssd.
> > > > > Do you have any suggestions?
> > > > >
> > > > > Thanks, bye.
> > > > > Morgan
> > > >
> > > > > _______________________________________________
> > > > > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> > > > > To unsubscribe send an email to
> > > > freeipa-users-leave@lists.fedorahosted.org
> > > > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > > > List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > > List Archives:
> > > >
> > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
> > > > _______________________________________________
> > > > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> > > > To unsubscribe send an email to
> > freeipa-users-leave@lists.fedorahosted.org
> > > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > > List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives:
> > > >
> > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
> > > >
> >
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> > > To unsubscribe send an email to
> > freeipa-users-leave@lists.fedorahosted.org
> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> > To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>