jhrozek, thank you for looking at the log fie; your recommendation helped narrow the scope
in this morning's troubleshooting efforts. We also have a Red Hat engineer here for
the week, and he was able to spot something in the sssd_default.log which caught his
attention. Long story short, issue has been resolved.
--------------------------------
Here's what was broken:
--------------------------------
ldap_schema = rfc2307bis <---
Caused this error:
Mon Apr 13 09:54:02 2015) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400):
calling ldap_search_ext with
[(&(memberUid=uid=lbogus,ou=People,dc=domain,dc=com)(objectClass=posixGroup)(cn=*))][dc=domain,dc=com].
Basically 'rfc2307bis' performed group searches using the full ldap string instead
of just the UID: (memberUid=uid=lbogus,ou=People,dc=domain,dc=com)
---------------------------
Here's what fixed it:
---------------------------
ldap_schema = rfc2307 <---
Resulted in the following search string:
(Mon Apr 13 10:02:06 2015) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400):
calling ldap_search_ext with
[>>>>>(&(memberUid=lbogus)<<<<<(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))][dc=domain,dc=com].
I could have swore I initially started working 'rfc2307' and ran into issues early
on using it, which is why I switched over to 'rfc2307bis' after some Google
results recommended the switch.
Thank you all for helping me out with this issue, I really appreciated the feedback and
pointers.
-LeoK
Date: Mon, 13 Apr 2015 11:16:11 +0200
From: jhrozek(a)redhat.com
To: sssd-users(a)lists.fedorahosted.org
Subject: Re: [SSSD-users] How do I view multiple users groups using sssd?
This is the interesting part:
(Fri Apr 10 16:25:52 2015) [sssd[be[default]]] [sdap_initgr_rfc2307bis_next_base]
(0x0400): Searching for parent groups for user [uid=lbogus,ou=People,dc=domain,dc=com]
with base [ou=Group,dc=domain,dc=com]
(Fri Apr 10 16:25:52 2015) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400):
calling ldap_search_ext with
[(&(member=uid=lbogus,ou=People,dc=domain,dc=com)(objectClass=posixGroup)(cn=*))][ou=Group,dc=domain,dc=com].
[...]
[sdap_initgr_rfc2307bis_process] (0x1000): Found 0 parent groups for user [lbogus]
So SSSD is trying to search the user groups with:
uid=lbogus,ou=People,dc=domain,dc=com
Can you check some of the secondary groups to see what attribute you use
to reference group members?
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users