All configuration files looks good to me.
I would say sssd works because you can authenticate to sssd_system.
You used rfc2307bis schema so I expect your LDAP server is rfc2307bis
compatible. But I do not understand why did you change the attribute
ldap_group_member.
man sssd-ldap says:
ldap_group_member (string)
The LDAP attribute that contains the names of the group's members.
Default: memberuid (rfc2307) / member (rfc2307bis)
It might explain why you cannot see all groups.
LS
It originally did not contain that line, it was added sometime this week in an attempt to
troubleshoot this issue.
https://fedorahosted.org/sssd/ticket/1280
Line was removed & modified, db cache flushed, error still remains; only one group
shows up.
-LK
From: unholi(a)hotmail.com
To: sssd-users(a)lists.fedorahosted.org
Subject: RE: How do I view multiple users groups using sssd?
Date: Fri, 10 Apr 2015 15:46:31 -0400
Is nss-pam-ldap installed on the problem host?
No, I believe I removed it during one of several troubleshooting tips I was trying out
this week.
I reinstalled it, and still got the same results.
Primary group show, but none of the other/secondary groups do.
-LK
From: unholi(a)hotmail.com
To: sssd-users(a)lists.fedorahosted.org
Subject: How do I view multiple users groups using sssd?
Date: Fri, 10 Apr 2015 14:32:13 -0400
SETUP
OS = RHEL 6.4 Workstation
System is part of a LDAP domain and was originally configured to authenticate using nscd.
This is a NON-Windows / NON-Active Directory environment, straight up *NIX.
All recommended SSSD packages have been installed.
[root@sssd_system]# rpm -qa | grep sssd
sssd-client-1.11.6-30.el6_6.4.x86_64
sssd-common-1.11.6-30.el6_6.4.x86_64
sssd-common-pac-1.11.6-30.el6_6.4.x86_64
sssd-krb5-common-1.11.6-30.el6_6.4.x86_64
sssd-ldap-1.11.6-30.el6_6.4.x86_64
sssd-proxy-1.11.6-30.el6_6.4.x86_64
sssd-tools-1.11.6-30.el6_6.4.x86_64
Files which have been created/modified to switch over to SSSD:
/etc/nsswitch.conf
[root@sssd_system]# ls -ld /etc/nsswitch.conf
-rw-r--r-- 1 root root 560 Apr 9 12:07 /etc/nsswitch.conf
cat /etc/nsswitch.conf
passwd: files sss
shadow: files sss
group: files sss
ethers: files sss
services: files sss
netgroup: files sss
/etc/sssd/sssd.conf
[root@sssd_system]# ls -ld /etc/sssd/sssd.conf
-rw------- 1 root root 971 Apr 9 11:48 /etc/sssd/sssd.conf
cat /etc/sssd/sssd.conf
[domain/default]
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_schema = rfc2307bis
ldap_uri =
ldap://server1.domain.com,ldap://server2.domian.com,ldap://server3.domian...
ldap_search_base = dc=domain,dc=com
ldap_user_search_base = ou=People,dc=domain,dc=com
ldap_group_search_base = ou=Group,dc=domain,dc=com
ldap_group_member = uniqueMember
ldap_id_use_start_tls = False
cache_credentials = True
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_cacert = /etc/openldap/cacerts/certname.pem
debug_level = 9
[sssd]
domains = default
services = nss,pam,autofs
config_file_version = 2
sbus_timeout = 30
[nss]
filter_groups = root
filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd
[pam]
reconnection_retries = 3
offline_credentials_expiration = 2
offline_failed_login_attempts = 3
offline_failed_login_delay = 5
[sudo]
[autofs]
[ssh]
NOTE: The authconfig
command was used to configure this system, so in theory, that means that
all the right files were touch with the correct information.
ISSUE [USERID@nscd_host]# groups USERID
USERID: USERGRP USERGRP2 USERGRP3 USERGRP4 USERGRP5
[USERID@nscd_host]# ssh USERID@sssd_system
Red Hat Enterprise Linux Workstation release 6.4 (Santiago)
Last login: Thu Apr 9 11:51:38 2015 from nscd_host
[USERID@sssd_system]# groups USERID
USERID: USERGRP
QUESTION
What am I missing?
I've been researching the dickens for a solution to what is likely a
simple configuration error, but haven't been able to pinpoint the exact
config file(s). I've also reference Red Hat's documentation on setting
up SSSD in their Deployment Guide and found several helpful guides posted out on the web.
And, I've also enabled debug level within sssd.conf file, but have not been able to
find anything overtly meaningful within the logs /var/log/sssd/* log file(s) or
/var/log/(message|secure) either.
Any assistance to what I might be missing would be greatly appreciated.
-LK