On ke, 07 helmi 2018, Boris Sukhinin via FreeIPA-users wrote:
I've tried the same setup with RHEL 7.5 beta and Fedora Server 27
but
still no luck.
Everything works fine (except there is no membership info for AD users
in cn=groups,cn=compat) until I add the following lines to the compat
plugin configuration in LDAP:
schema-compat-entry-attribute:
ipaexternalmember=%deref_r("member","ipaexternalmember")
schema-compat-entry-attribute: objectclass=ipaexternalgroup
These two lines are part
of the fix for
https://fedorahosted.org/freeipa/ticket/4403 which is in 4.4+
I think there is actually an additional fix needed, like this:
schema-compat-entry-attribute:
%ifeq("ipaexternalmember","%{ipaexternalmember}","ipaexternalmember:%{ipaexternalmember}","")
After that I get wierd behavior such as membership info in
cn=groups,cn=compat does not update at all or shows outdated
information. It also takes significantly longer to add or remove
members from groups.
I've uploaded SSSD logs with debug_level=10 to
https://drive.google.com/open?id=1DzJ5csjmxcLonwyYS_JGoQ2wFRbiPKiw for
the following command sequence (rebooted the server, cleared SSSD cache
and logs before that):
shell> ipa group-add-member external-group --external=aduser1(a)adlab.local
shell> ldapsearch -Y GSSAPI -b 'cn=groups,cn=compat,dc=idmlab,dc=local'
'(cn=posix-group)'
shell> ipa group-add-member external-group --external=aduser4(a)adlab.local
shell> ldapsearch -Y GSSAPI -b 'cn=groups,cn=compat,dc=idmlab,dc=local'
'(cn=posix-group)'
shell> ipa group-add-member external-group --external=aduser4(a)adlab.local
shell> ldapsearch -Y GSSAPI -b 'cn=groups,cn=compat,dc=idmlab,dc=local'
'(cn=posix-group)'
Also the very first attempt to add aduser4 failed with "member group:
aduser4(a)adlab.local: trusted domain object not found" while the second
one a few seconds later succeeded. It also seems that "ipa
group-add-member" returns correct membership info (at least for
external users) in its output.
This looks like a temporary offline state by sssd for
a trusted domain.
Am I missing something very important here or is it another bug?
I'll look at it
next week when I'll be back to work.
--
/ Alexander Bokovoy