On Thu, Jul 05, 2018 at 08:09:55PM +0000, Ratliff, John wrote:
On Thu, 2018-07-05 at 21:44 +0200, Sumit Bose wrote:
> On Thu, Jul 05, 2018 at 07:36:19PM +0000, Ratliff, John wrote:
> > I'm using SSSD and realmd to join a machine to active directory.
> >
> > When I run id on my user, I only get the primary group. If I run
> > getent
> > group "groupname", it works...sometimes. Other times, it returns
> > blank.
> >
> > This is on a CentOS 7 machine (sssd 1.16.0)
> >
> > $ id jdratlif
> > uid=752603752(jdratlif) gid=1572000513(domain users)
> > groups=1572000513(domain users)
> >
> > $ getent group ssh-test-users2
> > ssh-test-users2:*:752629809:
>
> What is the scope is the group ('domain local', 'global' or
> 'universal')?
>
> Did you log in as jdratlif before running those commands?
>
The scope is universal.
I was logged in as root at the time. But I've logged in as that user
prior to running those commands.
I logged in as the user and ran the commands again with the same
result.
It seems if I clear the cache, then run the getent command, it has the
group membership. But when I run the id command, the getent command
loses the group membership. I cannot get it back without clearing the
sssd cache.
Thank you for the logs. It looks like the tokenGroups LDAP lookup which
SSSD uses be default does not work as expected because it returns no
results:
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_print_server] (0x2000): Searching
134.68.239.131:389
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_get_generic_ext_step] (0x0400):
calling ldap_search_ext with [no filter][CN=jdratlif,OU=Accounts,DC=ads,DC=iu,DC=edu].
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [tokenGroups]
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_get_generic_ext_step] (0x2000):
ldap_search_ext called, msgid = 15
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_op_add] (0x2000): New operation 15
timeout 6
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_process_result] (0x2000): Trace:
sh[0x564b5d62f090], connected[1], ops[(nil)], ldap[0x564b5d62d1e0]
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_process_result] (0x2000): Trace:
end of ldap_result list
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_process_result] (0x2000): Trace:
sh[0x564b5d61dd00], connected[1], ops[0x564b5d63a360], ldap[0x564b5d5a0c60]
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_process_message] (0x4000): Message
type: [LDAP_RES_SEARCH_ENTRY]
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_parse_entry] (0x1000): OriginalDN:
[CN=jdratlif,OU=Accounts,DC=ads,DC=iu,DC=edu].
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_parse_entry] (0x1000): Entry has
no attributes [0(Success)]!?
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_process_result] (0x2000): Trace:
sh[0x564b5d61dd00], connected[1], ops[0x564b5d63a360], ldap[0x564b5d5a0c60]
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_process_message] (0x4000): Message
type: [LDAP_RES_SEARCH_RESULT]
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_get_generic_op_finished] (0x0400):
Search result: Success(0), no errmsg set
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_op_destructor] (0x2000): Operation
15 finished
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [sdap_get_ad_tokengroups_done] (0x1000):
No tokenGroups entries for [jdratlif(a)ads.iu.edu]
(Thu Jul 5 16:04:42 2018) [sssd[be[ads.iu.edu]]] [ldb] (0x4000): start ldb transaction
(nesting: 0)
this makes SSSD assume that the user is not a member of any group.
Please try to set 'ldap_use_tokengroups=False' (see man sssd-ldap for
details) and check if the group memberships are reported more reliable.
Afaik the issue with the tokenGroups might indicate that the used AD DC
has issues reaching a Global Catalog server.
HTH
bye,
Sumit
>
> > >
> > > $ sss_cache -E
> > > $ getent group ssh-test-users2
> > > ssh-test-users2:*:752629809:jdratlif
> > >
> > > $ id jdratlif
> > > uid=752603752(jdratlif) gid=1572000513(domain users)
> > > groups=1572000513(domain users)
> > >
> > > $ getent group ssh-test-users2
> > > ssh-test-users2:*:752629809:
> > >
> > > $ id jdratlif
> > > uid=752603752(jdratlif) gid=1572000513(domain users)
> > > groups=1572000513(domain users)
> > >
> > > This was all in the span of 2 minutes.
> > >
> > > Let me know what other information would be helpful.
> >
> > Debug logs with debug_level=9 would be helpful, especially the domain
> > logs and the sssd_nss.log. Please see
> >
https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html for
> > details.
>
> I have attached the requested logs.
>
> Thanks.
>
> >
> > bye,
> > Sumit