On Thu, Dec 03, 2020 at 03:55:11PM +0100, Natxo Asenjo via FreeIPA-users wrote:
hi,
reposting with zipped log.
we have a trust between an AD forest (2016) and an RHEL 7 Idm environment.
We have this ad group:
$ ipa group-show d-xxx-platform-admins
Group name: d-xxx-platform-admins
Description: AD d-xxx-platform-admins
External member: d-xxx-platform-admins(a)ad.local
Member of groups: xxx-platform-admins
When I run the command getent group xxx-platform-admins on the kdc, I get
the full list of users in the AD group:
$ getent group xxx-platform-admins
xxx-platform-admins:*:1679450504:a-user1@ad.local,a-user2@ad.local
,a-user3@ad.local,a-user4@ad.local,a-user5@ad.local,a-user6(a)ad.local
,a-user7@ad.local,a-user8@ad.local,a-user9@ad.local,a-user10(a)ad.local
,a-user11@ad.local,a-user12@ad.local,a-user12@ad.local,a-user13(a)ad.local
,a-user14@ad.local,a-user15@ad.local,a-user16(a)ad.local
but on the idm client:
# getent group xxx-platform-admins
xxx-platform-admins:*:1679450504:a-user1@ad.local,a-user2@ad.local
Attached the sssd_nss.log with debuggging enabled.
Hi,
looks like there is an issue with the 'Domain Users(a)ad.local' group, the
primary group of the AD users. Can you attach the sssd_domain.name.log
file with debug_level=9 in the [domain/...] section of sssd.conf from
the client as well together with the output of
getent group 'Domain Users(a)ad.local'
getent group 1576200513
from the server and the client?
bye,
Sumit
Thanks in advance.
--
regards,
Natxo
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...