That's for the quick response.  Unfortunately, that's not the behavior I'm seeing.  Here's what I see:

1) Log in as root, erase the cache, and restart SSSD.
2) Log in as the user and try a "touch test" in a directory controlled by ACL.
3) Get permission denied error.
4) As the user (root does not have to do this) run: getent group test-group which shows the correct membership from Active Directory.
5) Attempt another "touch test", still permission denied.
6) Log out and then log back in.
7) One more "touch test" and it works.


--
Peter Kirby
System and Database Administrator @ Harding University


On Mon, Aug 18, 2014 at 12:40 PM, Dmitri Pal <dpal@redhat.com> wrote:
On 08/18/2014 07:07 PM, Peter Kirby wrote:
I'm running CentOS 7, fully updated with SSSD version 1.11.2.  I used realm to setup SSSD and everything seems to be working fine for authentication.  I'm even able to filter access based on an ldap group.  My id and access providers are both set to ad.

When I try to run: id username, all I get is the "domain users" group listed as the primary group.  However, if I run something like: getent group test-group, and then again run id on a user in that group, test-group now shows up in the list along with domain users.

While I don't particularly care about the output from id, I'm seeing the same behavior when trying to use ACLs.  The scenario is the same as above.  Before getent group test-group, the users do not have access via ACL to files.  As soon as I run getent, everything starts working as it should.

I have tried enumerate = true in sssd.conf and confirmed sss is in nsswitch.conf where it should be, but I cannot seem to make remote groups work.

I suspect I'm missing something very small, but I've been searching manuals, google, and the logs for days and I haven't found any solution yet.  I would appreciate any suggestions anyone might have.

You need to log as the user. Then all his groups will be fetched.
id command does not fetch everything because it will be too costly but when user logs in all his groups are fetched and all the file access is properly enforced.

HTH


Thanks,
Peter

--
Peter Kirby
System and Database Administrator @ Harding University


_______________________________________________
sssd-users mailing list
sssd-users@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.

_______________________________________________
sssd-users mailing list
sssd-users@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users