Hi Alexander,
On 24 Oct 2020, at 14:41, Alexander Bokovoy <[1]abokovoy(a)redhat.com>
wrote:
On Sat, 24 Oct 2020, Vin??cius Ferr??o via FreeIPA-users wrote:
Hello,
I???m aware that we can make overrides on AD users with the Default
Trust View object on IPA. I???ve created another one for specific
users
named ???Clients Trust??? and added three user accounts there. Made
the
overrides that I want, and when I checked with getent on a Linux
client, the overrides aren???t worked.
On the new ID view, there???s this Host options, so I checked two
hosts
that I???m interested, and still didn???t override.
As a last resort I???ve reset sssd cache, with sss_cache -E, but no
success either.
So the question is: Is it supported to override AD users in other
trust
than the default trust view? If yes how can I debug with the override
isn???t working?
SSSD only refreshes individual ID view per host during restarts. And
yes, you need to clean up the cache if you changed which view applies to
which client. The reason for that is that changing UID/GID mapping for
existing processes running under those UID/GIDs is not possible (they
are set at start by kernel) unless application is specially made to
support it. Changing ID view is considered to be a potentially
destructive operation to existing machine state due to this.
'Default Trust View' is applied automatically by SSSD on the IPA
masters, thus any additional view should be applied explicitly to a
host.
See
[
2]https://www.freeipa.org/page/V4/Migrating_existing_environments_to_Trust
for details how ID views are supposed to work.
Thanks for in deed documentation, and as I can see I done the homework
correctly.
My case seems to be the last grouped picture, the one with the subtitle:
On this figure there is no override in the default view defined for the AD
object A. SSSD will return the data from AD unmodified and the extdom
plugin or the compat tree will override the gidNumber if view xyz is
requested for the AD object A.
And in fact is what I’ve done. But I didn’t changed UID/GID, I always keep
this default, I just populated missing data from AD: login shell, home and
ssh keys. But it still does not work as expected. I already rebooted both
IPA server and the host.
And I still get wrong information:
[root@login ~]# getent passwd [3]gomi(a)clientes.versatushpc.com.br
[4]11999056769@win.versatushpc.com.br:*:1499402616:1499402616:Edson
Satoshi Gomi:/home/[5]win.versatushpc.com.br/11999056769:
Anything that I should be looking for?
You can use SSSD troubleshooting guide to see if there is anything in
SSSD logs that break for you on the client side -- the non-default ID
view is always applied by the client. See
for debuging hints.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland