Hi everyone,
In dev environnement, with SSSD 1.16.2 (release 13.el7_6.5) on RHEL 7.6
SSSD is configured to request on mch.dev domain. trusted subdomain sub.mch.dev exist
(Win2k16)
On mch.dev, I have an user 'user1' in Universal groups 'G_TEST' and
'allowed_ssh'. These groups are placed also in mch.dev domain.
On sub.mch.dev, I have user 'user2' only. 'user2' is place in
'G_TEST' and 'allowed_ssh'.
When get id user from mch.dev domain, by `id mch\user1` I get this result :
`uid=83701115(user1) gid=513(sssdgrp)
groups=513(sssdgrp),83701107(allowed_ssh),83701117(g_test)`, but `id sub\user2`, in same
group (universal - child trust), I get `uid=69901104(user2) gid=69901104(user2)
groups=69901104(user2)` without group name
getent work fine : `getent group 'g_test'` result :
`g_test:*:83701117:user2,user1,mch`
Why I have not groupname for user2 ?
sssd.conf :
[sssd]
domains = mch.dev
config_file_version = 2
services = nss, pam
default_domain_suffix = mch.dev
full_name_format = %1$s
[nss]
filter_users = root
reconnection_retries = 3
entry_cache_nowait_percentage = 75
[pam]
pam_pwd_expiration_warning = 21
pam_account_expired_message = Account/password expired, please use selfservice portal
to change your password and logon again.
[domain/MCH.DEV]
debug_level = 9
id_provider = ad
access_provider = ad
auth_provider = ad
ad_domain = mch.dev
krb5_realm = MCH.DEV
krb5_store_password_if_offline = True
cache_credentials = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
override_gid = 513
fallback_homedir = /home/%u@%d
default_shell = /bin/bash
dyndns_update = false
ldap_idmap_range_min = 100000
ldap_use_tokengroups = False
krb5.conf
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_ccache_name = KEYRING:persistent:%{uid}
default_realm = MCH.DEV
[realms]
MCH.DEV = {
}
[domain_realm]
mch.dev = MCH.DEV
.mch.dev = MCH.DEV
Logs available here:
https://pastebin.com/Ntt62Cxt
Thanks in advance
@Jakub Hrozek jhrozek@redhat.com<mailto:jhrozek@redhat.com>
With the configuration above, Inverse of your problem : I can't view and use group for
sub domain user, but I can login with SSH like this : 'ssh -l 'sub\user2'
172.31.8.88'