On pe, 16 elo 2019, Alexander Bokovoy via FreeIPA-users wrote:
On pe, 16 elo 2019, Martijn Bakkes via FreeIPA-users wrote:
>
>>because domain local
>>groups should not be mappable, for sure.
>>
>
>You're saying our IdM is functioning in a technically impossible way?
Please show logs, that's all I'm saying, before coming to any conclusion.
Below is the filtering logic within SSSD:
/* Only security groups from AD are considered for POSIX groups.
* Additionally only global and universal group are taken to account
* for trusted domains. */
if (!(ad_group_type & SDAP_AD_GROUP_TYPE_SECURITY)
|| (IS_SUBDOMAIN(dom)
&& (!((ad_group_type & SDAP_AD_GROUP_TYPE_GLOBAL)
|| (ad_group_type & SDAP_AD_GROUP_TYPE_UNIVERSAL))))) {
DEBUG(SSSDBG_TRACE_FUNC,
"Filtering AD group [%s].\n", group_name);
*_need_filter = true;
}
Note that we have a bug against IPA to not allow domain local groups as
external members but it needs API extension from SSSD side to expose the
group type. Right now you could add domain local group (it can be
resolved) and it will be filtered out later by AD DC from the user's
Kerberos ticket, thus disappearing from a group membership when applying
it by HBAC rules or at login time by SSSD:
https://pagure.io/freeipa/issue/6947
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland