I'm not setting up anything. This is something that is done far
upstream from me, that I have no control over. I think it was done by Windows people that
don't ever use Linux. I would have rather they pointed the gidNumber to Domain Users
than fill it with useless data. Is there any way to get sssd to ignore it other than doing
my own id mapping?
I would get your boss to speak to their boss and get him to point out
how inept they are, I mean, how hard is it to find out just what is
required in AD ?
You are correct, you need 'Domain Users' to have a gidNumber and then
all your users need this gidNumber, they do not need a separate personal
user group.
Failing the inept windows admins changing AD, I would suggest that you
set up your own Samba4 AD DC.
Rowland
-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org
[mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Rowland Penny
Sent: Monday, July 13, 2015 2:37 PM
To: sssd-users(a)lists.fedorahosted.org
Subject: Re: [SSSD-users] gidNumber resolution problem
On 13/07/15 20:24, Thackeray, Neil L wrote:
> gidNumber '182275' is the gidNumber in my LDAP entry only. There is no actual
group corresponding to this gidNumber. I have zero control over how our AD is configured,
so I couldn't change this if I wanted to.
And there is your problem, whilst you can add a gidNumber to a users object in AD, it is
meaningless unless it is also the gidNumber of an actual group in AD. I think you are
trying to set up a personal usergroup with the same name as your user, this is not allowed
in AD.
Rowland
> dn: CN=neilt,OU=People,DC=ad,DC=mydomain,DC=edu
> objectClass: top
> objectClass: person
> objectClass: organizationalPerson
> objectClass: user
> givenName: Neil
> distinguishedName: CN=neilt,OU=People,DC=ad,DC=mydomain,DC=edu
> instanceType: 4
> uidNumber: 182275
> gidNumber: 182275
> extensionAttribute2: O365
> SAMAccountType: 805306368
>
> -----Original Message-----
> From: sssd-users-bounces(a)lists.fedorahosted.org
> [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of
> Rowland Penny
> Sent: Monday, July 13, 2015 1:06 PM
> To: sssd-users(a)lists.fedorahosted.org
> Subject: Re: [SSSD-users] gidNumber resolution problem
>
> On 13/07/15 18:42, Thackeray, Neil L wrote:
>> I've upgraded to 1.12.5, but the result is still the same. I don't
understand why sssd is treating my gidNumber as a group when it resides in the users entry
in objectclass user.
>>
>> This ldap search doesn't work: ldapsearch -LLL -x -H
ldaps://ldaps.ad.mydomain.edu:636/ -b dc=ad,dc=mydomain,dc=edu -D
bi-svc-ems(a)ad.mydomain.edu -W -s sub
"(&(gidNumber=182275)(objectClass=group)(name=*)(&(gidNumber=*)(!(gidNumber=0))))"
>>
>> This ldap search does work: ldapsearch -LLL -x -H
ldaps://ldaps.ad.mydomain.edu:636/ -b dc=ad,dc=mydomain,dc=edu -D
bi-svc-ems(a)ad.mydomain.edu -W -s sub
"(&(gidNumber=182275)(objectClass=user)(name=*)(&(gidNumber=*)(!(gidNumber=0))))"
> Hi, does the gidNumber '182275' have a corresponding group to go with it ?
>
> Rowland
>
>> This is part of what the debug for nss looks like. It seems that it's
>> connecting (Mon Jul 13 11:40:22 2015) [sssd[nss]]
>> [sss_dp_issue_request] (0x0400): Issuing request for
>> [0x41b210:2:182275@ad.mydomain.edu]
>> (Mon Jul 13 11:40:22 2015) [sssd[nss]] [sss_dp_get_account_msg]
>> (0x0400): Creating request for
>> [ad.mydomain.edu][4098][1][idnumber=182\
>> 275]
>> (Mon Jul 13 11:40:22 2015) [sssd[nss]] [sbus_add_timeout] (0x2000):
>> 0x175ef80 (Mon Jul 13 11:40:22 2015) [sssd[nss]]
>> [sss_dp_internal_get_send] (0x0400): Entering request
>> [0x41b210:2:182275@ad.mydomain.edu]
>> (Mon Jul 13 11:40:22 2015) [sssd[nss]] [nss_cmd_getgrgid_search]
>> (0x0080): No matching domain found for [182275] (Mon Jul 13 11:40:22
>> 2015) [sssd[nss]] [sbus_remove_timeout] (0x2000): 0x175ef80 (Mon Jul
>> 13 11:40:22 2015) [sssd[nss]] [sbus_dispatch] (0x4000): dbus conn: 0x175a650 (Mon
Jul 13 11:40:22 2015) [sssd[nss]] [sbus_dispatch] (0x4000): Dispatching.
>> (Mon Jul 13 11:40:22 2015) [sssd[nss]] [sss_dp_get_reply] (0x1000):
>> Got reply from Data Provider - DP error code: 1 errno: 11 error mes\
>> sage: Fast reply - offline
>> (Mon Jul 13 11:40:22 2015) [sssd[nss]] [nss_cmd_getby_dp_callback]
>> (0x0040): Unable to get information from Data Provider
>> Error: 1, 11, Fast reply - offline
>>
>> -----Original Message-----
>> From: sssd-users-bounces(a)lists.fedorahosted.org
>> [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Lukas
>> Slebodnik
>> Sent: Friday, July 10, 2015 2:45 AM
>> To: End-user discussions about the System Security Services Daemon
>> Subject: Re: [SSSD-users] gidNumber resolution problem
>>
>> On (09/07/15 22:36), Thackeray, Neil L wrote:
>>> I'm new to sssd, so I'm not sure I have everything set up correctly,
but from what I've seen setting up authentication against AD should be fairly easy.
>>>
>>> I'm able to authenticate, and group lookups seem to work during
authentication. When I look through the sssd domain log I see it going through my groups
and enumerating users.
>>>
>>> Unfortunately, it's not able to resolve my gidNumber which is in my
personal LDAP entry in the user objectclass not in the group objectclass.
>>>
>>> This log entry happens when I into ssh into the server or run
'groups' from the command line.
>>> (Thu Jul 9 13:56:24 2015) [sssd[be[ad.mydomain.edu]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(gidNumber=182275)(objectclass=group)(name=*)(&(gidNumber=*)(!(gidNumber=0))))][DC=ad,DC=mydomain,DC=edu].
>>>
>>> Output of running 'groups' while my account is logged in:
>>> groups: cannot find name for group ID 182275
>>> 182275
>>>
>>> I'm in a lot of groups, so I can only assume that it tries to resolve my
gidNumber, can't and gives up.
>>>
>>> sssd version 1.11.5
>> 1.11.5 may contain some bugs. So please test with latest 1.11 version
>> or latest 1.12 version
>>
>>> sssd.conf
>>> [sssd]
>>> domains =
ad.mydomain.edu
>>> config_file_version = 2
>>> services = nss, pam, pac
>>>
>>> [
domain/ad.mydomain.edu]
>>> debug_level = 9
>>> ad_domain =
ad.mydomain.edu
>>>
>>> id_provider = ad
>>> auth_provider = ad
>>> access_provider = ad
>>> chpass_provider = ad
>>>
>>> realmd_tags = manages-system joined-with-samba cache_credentials =
>>> True krb5_store_password_if_offline = True default_shell = /bin/bash
>>> ldap_id_mapping = False use_fully_qualified_names = False
>>> fallback_homedir = /home/%u ignore_group_members = False
>>> ipa_hbac_support_srchost = True
>> This option will be ingored because it is an ipa related option and you are using
ad provider.
>>
>>> ad_access_filter = memberOf=CN=MyOU IT FT,OU=Groups -
>>> DLs,OU=ITS,OU=MyOU,OU=City,DC=ad,DC=mydomain,DC=ed
>> Does it work if you remove this line?
>>
>> BTW you can use simple access provider instead of such filter.
>> @see man sssd-simple
>>
>> I would also recomment to read our wiki page
>>
https://fedorahosted.org/sssd/wiki/Troubleshooting
>>
>> LS
>> _______________________________________________
>> sssd-users mailing list
>> sssd-users(a)lists.fedorahosted.org
>>
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
>> _______________________________________________
>> sssd-users mailing list
>> sssd-users(a)lists.fedorahosted.org
>>
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users