On 08/18/2014 07:07 PM, Peter Kirby wrote:
I'm running CentOS 7, fully updated with SSSD version 1.11.2. I
used
realm to setup SSSD and everything seems to be working fine for
authentication. I'm even able to filter access based on an ldap
group. My id and access providers are both set to ad.
When I try to run: id username, all I get is the "domain users" group
listed as the primary group. However, if I run something like: getent
group test-group, and then again run id on a user in that group,
test-group now shows up in the list along with domain users.
While I don't particularly care about the output from id, I'm seeing
the same behavior when trying to use ACLs. The scenario is the same
as above. Before getent group test-group, the users do not have
access via ACL to files. As soon as I run getent, everything starts
working as it should.
I have tried enumerate = true in sssd.conf and confirmed sss is in
nsswitch.conf where it should be, but I cannot seem to make remote
groups work.
I suspect I'm missing something very small, but I've been searching
manuals, google, and the logs for days and I haven't found any
solution yet. I would appreciate any suggestions anyone might have.
You need to log as the user. Then all his groups will be fetched.
id command does not fetch everything because it will be too costly but
when user logs in all his groups are fetched and all the file access is
properly enforced.
HTH
Thanks,
Peter
--
Peter Kirby
System and Database Administrator @ Harding University
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.