URL:
https://github.com/SSSD/sssd/pull/5784
Title: #5784: proxy: allow removing group members
sumit-bose commented:
"""
@sumit-bose , can it happen (is it supported) two groups in different
domains have the same GID?
Hi,
if the two domains are managed separately it can of course happen that two groups have the
same GID. For lookups by GID the group from the first domain listed in the `domains`
option will win. A lookup by name, especially with a fully-qualified name, will most
probably resolve both groups.
Given that the `id` command will do lookups by GID an `id` lookup for the user from the
second domain which is a member of the group with the duplicated GID will return the wrong
group name. In this sense I would say we do not support this kind of configuration.
Additionally, the filesystem is doing access control based with respect to groups with the
help of the GID using the same GID in different domains might give users access to files
of users from the other domain, which is typically not expected.
HTH
bye,
Sumit
"""
See the full comment at
https://github.com/SSSD/sssd/pull/5784#issuecomment-934479813