On Fri, Mar 29, 2019 at 9:25 AM Hans Schou <hsc(a)miracle.dk> wrote:
"getent group <name>" does not give any output at
all.
However "getent passwd" looks correctly up in the AD:
$ getent passwd zmir2
zmir2:*:2956636:100:Hans Schou:/home/zmir2:/bin/bash
$ grep -c ^zmir2 /etc/passwd
0
nsswitch looks fine:
$ egrep "^(group|passwd)" /etc/nsswitch.conf
passwd: files sss
group: files sss
…
# cat /etc/sssd/sssd.conf
[sssd]
domains =
foo.org
config_file_version = 2
services = nss, pam
[
domain/foo.org]
ad_domain =
foo.org
krb5_realm =
FOO.ORG
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
fallback_homedir = /home/%u
access_provider = ad
All on Red Hat 7.6.
The goal is to use an AD group in a samba share but it obviously
does not lookup groups in the AD, only specific users.
Two things to check:
1. You are setting ldap_id_mapping = False, so that means sssd will
only map groups that have the gidNumber attribute. If there is no
gidNumber attribute on the group, sssd ignores it.
2. sssd only maps only security groups (universal, domain local,
global).
In terms of #2, here are the AD group types, with an asterisk next to
the ones that sssd maps:
* groupType: -2147483646 (global security group)
* groupType: -2147483644 (domain local security group)
groupType: -2147483643 (builtin group)
* groupType: -2147483640 (universal security group)
groupType: 2 (global distribution group)
groupType: 4 (local distribution group)
groupType: 8 (universal distribution group)
If you want sssd to map a universal distribution group, you will need
to change it to be a mail-enabled universal security group instead.