> Op 28 jan. 2016, om 18:03 heeft Jakub Hrozek <jhrozek(a)redhat.com> het volgende
geschreven:
>
> On Wed, Jan 27, 2016 at 10:29:06PM +0100, Bolke de Bruin wrote:
>>
>>> Op 27 jan. 2016, om 22:25 heeft Jakub Hrozek <jhrozek(a)redhat.com> het
volgende geschreven:
>>>
>>>
>>>> On 27 Jan 2016, at 17:50, Bolke de Bruin <bdbruin(a)gmail.com>
wrote:
>>>>
>>>>>
>>>>> Op 27 jan. 2016, om 17:46 heeft Jakub Hrozek
<jhrozek(a)redhat.com> het volgende geschreven:
>>>>>
>>>>> On Wed, Jan 27, 2016 at 05:42:02PM +0100, Bolke de Bruin wrote:
>>>>>> Hello,
>>>>>>
>>>>>> I have sssd 1.13.00 working against FreeIPA 4.2 domain. This
domain has a trust relationship with a active directory domain.
>>>>>>
>>>>>> One of the systems we are using requires to enumerate all users
in groups by (unfortunate) design (Apache Ranger). This is done by using
>>>>>> “getent group”. During this enumeration the full user list for a
group that has a nested external member group* is not always returned so we thought to
>>>>>> add “getent group mygroup” in order to get more details.
Unfortunately this does not seem to work consistently: sometimes this gives information
sometimes it does not:
>>>>>>
>>>>>> [root@master centos]# getent group ad_users
>>>>>> ad_users:*:1950000004:
>>>>>>
>>>>>> [root@master centos]# id bolke(a)ad.local
>>>>>> UID=1796201107(bolke(a)ad.local) GID=1796201107(bolke(a)ad.local)
groepen=1796201107(bolke(a)ad.local),1796200513(domain
users@ad.local),1796201108(test(a)ad.local)
>>>>>>
>>>>>> [root@master centos]# getent group ad_users
>>>>>> ad_users:*:1950000004:bolke@ad.local
<mailto:bolke@ad.local>
>>>>>>
>>>>>> If I clear the cache (sss_cache -E) the entry is gone again:
>>>>>>
>>>>>> [root@master centos]# getent group ad_users
>>>>>> ad_users:*:1950000004:
>>>>>>
>>>>>> My question is how do I get sssd to enumerate *all users* in a
group consistently?
>>>>>>
>>>>>> Thanks!
>>>>>> Bolke
>>>>>
>>>>> ad_users is an IPA group that contains an IPA external group that
>>>>> contains the users, right?
>>>>
>>>> Correct.
>>>>
>>>>>
>>>>> If so, then you're hitting:
>>>>>
https://fedorahosted.org/sssd/ticket/2522
>>>>> I've been working on fixing this lately and have some patches,
would you
>>>>> like to test them?
>>>>
>>>> Sure. I would prefer RPMs (this is on RHEL 6 and 7) but I can compile if
required.
>>>>
>>>>
>>>
>>> This issue must be fixed with sssd on the IPA server itself. Please send me
your exact sssd version (rpm -q output) and I'll build you a test package tomorrow..
>>>
>>
>> rpm -qa sssd*
>> sssd-common-pac-1.13.0-40.el7_2.1.x86_64
>> sssd-krb5-1.13.0-40.el7_2.1.x86_64
>> sssd-client-1.13.0-40.el7_2.1.x86_64
>> sssd-krb5-common-1.13.0-40.el7_2.1.x86_64
>> sssd-ipa-1.13.0-40.el7_2.1.x86_64
>> sssd-ldap-1.13.0-40.el7_2.1.x86_64
>> sssd-proxy-1.13.0-40.el7_2.1.x86_64
>> sssd-common-1.13.0-40.el7_2.1.x86_64
>> sssd-ad-1.13.0-40.el7_2.1.x86_64
>> sssd-1.13.0-40.el7_2.1.x86_64
>>
>>
>> To confirm: Is the idea behind your patches that it will enumerate users in
groups that have not logged before? Ie. I have no means to determine which users are in a
group on the sssd/ipa side.
>
> Hello Bolke, please try these builds:
>
https://jhrozek.fedorapeople.org/sssd-test-builds/sssd-7.2-external-groups/
>
> These do resolve the AD members via an IPA group for me:
> # rm -f /var/lib/sss/db/cache_ipa.test.ldb
> # systemctl start sssd.service
> # getent group l_idm_admin
> l_idm_admin:*:1190000005:Administrator@win.trust.test,pkuser@win.trust.test
>
> The groups are defined like this:
> # ipa group-show l_idm_admin
> Group name: l_idm_admin
> GID: 1190000005
> Member groups: l_idm_admin_external
> # ipa group-show l_idm_admin_external
> Group name: l_idm_admin_external
> Member of groups: l_idm_admin
> External member: extgroup(a)win.trust.test, administrator(a)win.trust.test
>
> (So the code even crawls the AD group and unrolls the pkuser from there)
Cool, but the files are currently inaccessible (403). Would you mind updating the
permissions?