Hi everyone,
I'm using sssd-ad and I have unexpected behaviour with the ldap_mapping_id module.
I'll try to be clear as possible :)
The unexpected behaviour concerned Group ID, they are inconsistency.
For any reason, at any moment GIDs can be changed.
The AD contains about 10 domains, and 200 000 users. Domain RIDs can be very large.
I override the min, max, and slice values to extend the available window.
I've also set a default domain sid in order to be sure one (the main) domain will be
consistency.
But it doesn't work.
What can be the origin of GIDs overwriting?
Maybe, I have a problem with my configuration file.
/etc/sssd/sssd.conf
[sssd]
config_file_version = 2
services = nss, pam, sudo
domains = LDAP, domain.ad
[nss]
filter_groups = root,ldap,named,avahi,haldaemon,dbus,...
filter_users = root,ldap,named,avahi,haldaemon,dbus, ...
[pam]
[sudo]
[domain/LDAP]
id_provider = ldap
sudo_provider = ldap
auth_provider = ldap
cache_credentials = True
ldap_uri = ldaps://ldap1:636
ldap_tls_cacert = /etc/openldap/cacerts/ldap_rootca.pem
ldap_tls_reqcert = hard
ldap_default_bind_dn = ...
ldap_default_authtok_type = obfuscated_password
ldap_default_authtok = ...
ldap_search_base = base_dn
enumerate = True
ldap_referrals = False
ldap_schema = rfc2307
ldap_sudo_search_base = base_dn
[domain/domain.ad]
id_provider = ldap
access_provider = ad
auth_provider = ad
cache_credentials = True
enumerate = False
debug_level = 9
## Override attributes
override_gid = 513
override_homedir = /data/users/%u
default_shell = /bin/bash
## LDAP config
ldap_uri = ldaps://ad-server:3269
ldap_tls_cacert = /etc/openldap/cacerts/bundle-certificates.pem
ldap_tls_reqcert = hard
ldap_search_base = base_dn
ldap_group_search_base = group_dn
ldap_schema = ad
## Mapping confiugration
ldap_id_mapping = True
ldap_idmap_default_domain_sid = S-1-5-21-...932
# Allow 2000 domains, and 1 million entries per domain
# Min uid for AD account (100000)
ldap_idmap_range_min = 100000
ldap_idmap_range_max = 2000100000
ldap_idmap_range_size = 1000000
I've just found this in the log file.
(Wed Aug 26 15:22:37 2015) [sssd[be[dc.example.com]]] [ldb] (0x4000): commit ldb
transaction (nesting: 3)
(Wed Aug 26 15:22:37 2015) [sssd[be[dc.example.com]]] [sdap_get_primary_name] (0x0400):
Processing object grp_cluster1_developer
(Wed Aug 26 15:22:37 2015) [sssd[be[dc.example.com]]] [sdap_get_primary_name] (0x0400):
Processing object grp_audit_cluster1_developer
(Wed Aug 26 15:22:37 2015) [sssd[be[dc.example.com]]] [sdap_get_primary_name] (0x0400):
Processing object grp_audit_cluster1_user
(Wed Aug 26 15:22:37 2015) [sssd[be[dc.example.com]]] [sdap_add_incomplete_groups]
(0x1000): Mapping group [grp_audit_cluster1_user] objectSID to unix ID
(Wed Aug 26 15:22:37 2015) [sssd[be[dc.example.com]]] [sdap_add_incomplete_groups]
(0x2000): Group [grp_audit_cluster1_user] has objectSID
[S-1-5-21-3095416536-3097367016-2845470932-840751]
(Wed Aug 26 15:22:37 2015) [sssd[be[dc.example.com]]] [sdap_add_incomplete_groups]
(0x2000): Group [grp_audit_cluster1_user] has mapped gid [940751]
(Wed Aug 26 15:22:37 2015) [sssd[be[dc.example.com]]] [sdap_add_incomplete_groups]
(0x2000): Adding fake group grp_audit_cluster1_user to sysdb
(Wed Aug 26 15:22:37 2015) [sssd[be[dc.example.com]]] [ldb] (0x4000): start ldb
transaction (nesting: 3)
(Wed Aug 26 15:22:37 2015) [sssd[be[dc.example.com]]] [ldb] (0x4000): Added timed event
"ltdb_callback": 0x1ee6fc0
[ ...]
(Wed Aug 26 15:22:38 2015) [sssd[be[dc.example.com]]] [ldb] (0x4000): commit ldb
transaction (nesting: 1)
(Wed Aug 26 15:22:38 2015) [sssd[be[dc.example.com]]] [ldb] (0x4000): start ldb
transaction (nesting: 1)
(Wed Aug 26 15:22:38 2015) [sssd[be[dc.example.com]]] [sdap_get_primary_name] (0x0400):
Processing object grp_audit_cluster1_user
(Wed Aug 26 15:22:38 2015) [sssd[be[dc.example.com]]] [sdap_save_group] (0x0400):
Processing group grp_audit_cluster1_user
(Wed Aug 26 15:22:38 2015) [sssd[be[dc.example.com]]] [sdap_save_group] (0x4000): AD group
[grp_audit_cluster1_user] has type flags 0x80000004.
(Wed Aug 26 15:22:38 2015) [sssd[be[dc.example.com]]] [sdap_save_group] (0x1000): Mapping
group [grp_audit_cluster1_user] objectSID
[S-1-5-21-3095416536-3097367016-2845470932-840751] to unix ID
(Wed Aug 26 15:22:38 2015) [sssd[be[dc.example.com]]] [sdap_attrs_add_ldap_attr] (0x2000):
Adding original DN [CN=grp_audit_cluster1_user,....] to attributes of
[grp_audit_cluster1_user].
(Wed Aug 26 15:22:38 2015) [sssd[be[dc.example.com]]] [sdap_attrs_add_ldap_attr] (0x2000):
Adding original mod-Timestamp [20150717152801.0Z] to attributes of
[grp_audit_cluster1_user].
(Wed Aug 26 15:22:38 2015) [sssd[be[dc.example.com]]] [sdap_process_ghost_members]
(0x0400): The group has 3 members
(Wed Aug 26 15:22:38 2015) [sssd[be[dc.example.com]]] [sdap_process_ghost_members]
(0x0400): Group has 3 members
(Wed Aug 26 15:22:38 2015) [sssd[be[dc.example.com]]] [sdap_process_ghost_members]
(0x0400): Adding ghost member for group [N5218058]
(Wed Aug 26 15:22:38 2015) [sssd[be[dc.example.com]]] [sdap_process_ghost_members]
(0x0400): Adding ghost member for group [O3049031]
(Wed Aug 26 15:22:38 2015) [sssd[be[dc.example.com]]] [sdap_save_group] (0x0400): Storing
info for group grp_audit_cluster1_user
Guillaume Polaert | Ingensi | @gpolaert -
https://twitter.com/gpolaert