On Wed, Sep 07, 2016 at 08:26:20AM -0400, Stephen Gallagher wrote:
On 09/07/2016 08:16 AM, Ondrej Valousek wrote:
> The config you have does not make any sense, really.
> Obviously you have id_mapping turned on - in this case SSSD ignores any RFC2307
attributes in AD - including loginshell.
> If you want SSSD to honour RFC2307 attrs in AD, you need to turn ldap_id_mapping
off.
That statement is incorrect. ID mapping *only* applies to UID and GID. SSSD will
still use the loginShell *if it is actually set*. If it's not set, then it will
just use the default_shell... which is explicitly set to /sbin/nologin.
More below.
>
> -----Original Message-----
> From: faktoriyel [mailto:faktoriyel@yahoo.com]
> Sent: Wednesday, September 07, 2016 1:06 PM
> To: sssd-users(a)lists.fedorahosted.org
> Subject: [SSSD-users] SSSD and Active Directory loginShell and unixHomeDirectory
caching problem.
>
> Hi Guys.
>
> This is my first question in this mailing list and I already apologize for the
missing info and logs . I use rhel 7.2 server and try the login from A.D with pam.. These
are my sssd version info
>
> sssd-common-pac-1.13.0-40.el7.x86_64
> sssd-krb5-1.13.0-40.el7.x86_64
> python-sssdconfig-1.13.0-40.el7.noarch
> sssd-client-1.13.0-40.el7.x86_64
> sssd-krb5-common-1.13.0-40.el7.x86_64
> sssd-ad-1.13.0-40.el7.x86_64
> sssd-ldap-1.13.0-40.el7.x86_64
> sssd-proxy-1.13.0-40.el7.x86_64
> sssd-common-1.13.0-40.el7.x86_64
> sssd-ipa-1.13.0-40.el7.x86_64
> sssd-1.13.0-40.el7.x86_64
>
> I have successfully join to A.D. with net ads join and start sssd service . here is
my sssd.conf file
>
> [sssd]
> config_file_version = 2
> services = nss, pam
> domains = xxx.local
>
> [nss]
> shell_fallback = /sbin/nologin
> allowed_shells = /bin/bash,/bin/sh
> default_shell = /sbin/nologin
> filter_groups = root
> filter_users = root
>
> [domain/default]
> cache_credentials = False
> ldap_enumeration_refresh_timeout = 600
> ldap_purge_cache_timeout = 600
>
> [domain/yurticikargo.local]
> id_provider = ad
> auth_provider = ad
> chpass_provider = ad
> access_provider = ad
> ad_server = xx01.xx.local,xx03.xx.local
> ad_domain = xx.local
> ldap_krb5_keytab = /etc/krb5.keytab
> ldap_krb5_init_creds = true
> ldap_idmap_range_size = 100000000
> ldap_idmap_range_max = 2000200000
> ldap_schema = ad
> cache_credentials = False
> ldap_enumeration_refresh_timeout = 600
> ldap_purge_cache_timeout = 600
> ldap_user_shell = loginShell
>
> after that when I check with getent any user account. I get correct info from active
directory especially abont loginShell and unixHomeDirectory field. I change login method
to sss and login with ssh everything is fine but when I logout and re-login user
loginShell and unixHomeDirectory info dissappear and I fall the nologin shell.
>
> After clean sssd cache file and fresh start sssd
>
> getent passwd xxxx
> xxxx:*:1101569237:1101586812:xxxxx:/home/applicationadmins:/bin/bash
>
> after ssh login logout with xxxx user
>
> getent passwd xxxx
> xxxx:*:1101569237:1101586812:xxxx:/:/sbin/nologin
>
> I think sssd doesn't cache iloginShell and unixHomeDirectory info from A.D.
and when I login first time write cache some info doesn't include this information.
When I re-login it gets info from cache files and dosen't find loginshell etc. And
then I fall the nologin shell. Is tihs a bug? or am I missing something.?
>
SSSD actually *only* returns data from the cache; never directly. (When the
cache is empty, we go to LDAP, update the cache, then we retrieve the cached
contents to return).
It certainly sounds like something is causing the cache to be *overwritten*,
though, which is quite odd. In this case, we really need debug logs to make any
sense of it.
I wonder if SSSD is connecting to the Global Catalog for some lookups
but not others, which yields the POSIX attributes as 'removed' when SSSD
looks up the info in GC and effectivelly removes them from the cache.
Setting:
ad_enable_gc = false
in the [domain] section would prove if this hypothesis is true.