[SSSD] UID/GID Mapping Incorrect

Andrew Wygle awygle at berkeley.edu
Tue Dec 18 02:00:21 UTC 2012



Hello, 

Thanks to the help of this list I successfully got SSSD to
authenticate against a Windows Server 2008 R2 Active Directory domain
controller. SSH logins work. I am, however, having a problem with UID and
GID mappings. I have set the following mappings in sssd.conf:


ldap_user_uid_number = uidNumber
ldap_user_gid_number =
gidNumber
ldap_group_gid_number = gidNumber 

I know these are the
defaults, but I specified them explicitly just in case. I see the same
behavior with them unset, which makes sense. 

When I go to look up a
user's information, either with getent or by logging in as them and running
id, I see that their UIDs and GIDs are set to ridiculously large values.
Take Bob as an example. I expect him to have UID 1001 and GID 1003, because
that's what's specified in Active Directory and when I run ldapsearch
that's what I see as the uidNumber and gidNumber properties. However, I get
the following result from getent passwd bob:


bob:*:863601112:863600513:Bobby Wallingford:/home/bob:/bin/bash 

This is
internally consistent - if I do getent group on Bob's primary group, it
returns the same GID as the one Bob is set to. However, I don't see the
same behavior on a Mac that is joined to our domain - there, id bob returns
1001 as his UID and 1003 as his GID. The only thing in the logs that looks
much like an error is a line that looks like: 

[sssd[be[domain.com]]]
[sdap_save_group] (0x1000): Mapping user [bob] objectSID to unix ID


(replace user with group and bob with the group name when searching for
groups). This doesn't exactly seem correct, but also doesn't seem like it
would produce the error I'm seeing. 

I didn't see any obvious pattern to
the bits either (endianness error, inverted somehow, some kind of weird
sign error, etc). 

Any help will be appreciated. 

Thanks, 

~Andrew Wygle
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121217/4812f6ab/attachment.html>


More information about the sssd-devel mailing list