On ke, 27 tammi 2021, Ronald Wimmer via FreeIPA-users wrote:
On 27.01.21 14:06, Alexander Bokovoy wrote:
>On ke, 27 tammi 2021, Ronald Wimmer via FreeIPA-users wrote:
>>On 27.01.21 13:28, White, Daniel E. (GSFC-770.0)[NICS] via
>>FreeIPA-users wrote:
>>>Please excuse a possible thread hijack
>>>
>>>Is this (IPA)global or can it be done on select hosts ?
>>
>>That would have been my next question. I would need that only on a
>>small subset of hosts too.
>
>This would be global.
>
>If you need this on specific hosts, just add IPA user to the local
>/etc/group.
>
>For example, this is what I have on my laptop:
>
>$ grep abokovoy /etc/passwd
>$ grep abokovoy /etc/group
>video:x:39:abokovoy
>audio:x:63:abokovoy
>$ getent initgroups abokovoy
>abokovoy 1792600060 1792600077 1792600000 1792600075
>1792600006 1792600073 1792600007 1792600084 1792600085 39 63
>$ getent group audio video
>audio:x:63:abokovoy
>video:x:39:abokovoy
>
>All the 1792* group IDs come from IPA while 39 and 63 are defined
>locally.
But I do still need a corresponding group and the initgroups line in
nsswitch.conf?
'initgroups' applies to the user, so merging happens when a process
is set up to run under user account, secondary groups are filled at that
point.
Actually, I have audio group created in IPA but video group is only
local. So group merging actually works here.
When I do a 'getent initgroups icinga@linux' I just get the
GID of the
docker group listed.
Check that you are on the system that has glibc with group merging
support and it is configured to do so.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland