On pe, 16 elo 2019, Blake Dworaczyk via FreeIPA-users wrote:
Thank you for the information, I do indeed see what you mean:
[sssd[be[ipa.engr.tamu.edu]]] [sdap_check_ad_group_type] (0x0400): Filtering AD group
[linux_team(a)engr.tamu.edu].
Is there any way to force SSSD not to filter out the domain local
groups? We use almost exclusively domain local groups in our AD because
our users often reside in a different domain than the groups due to
circumstances out of our control. This particular group
(linux_team(a)engr.tamu.edu) only contains users in the same domain as
the group, but this is often not the case. I had planned on creating a
trust to both domains, the domain that contains the groups (and some
users), and the domain that contains the bulk of our users.
Convert domain local group into a global group. This is the only way.
To make sure: this is a fundamental Active Directory design, not IPA.
Active Directory requires to filter domain local groups at a domain
boundary in Kerberos tickets. This means that a service in IPA domain
cannot see any domain local membership from a trusted domain by
definition. See MS-PAC 4.1.2.2,
https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/55fc1...
On a very puzzling note, when I first set up my IPA domain, I was
able
to get back results from a 'getent group linux_team' that properly
contained all of the group members. However, I could only get this to
work on the IPA server. When I tried this on a client I got the results
that I am seeing now. During the process of debugging I stopped getting
any members returned on either client or server. This is particularly
strange because all of my settings appear to be the same as before when
it was working on the server.
See previous answer -- SSSD filters them when you are
trying to login
with a user that has these groups missing in MS-PAC.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland