[SSSD] Mixing passwd accounts with LDAP groups issue

Stephen Gallagher sgallagh at redhat.com
Tue Jul 3 11:58:08 UTC 2012


On Fri, 2012-06-29 at 20:47 +0200, Jan Engelhardt wrote:
> Hi,
> 
> 
> I have my user account listed in both /etc/passwd, /etc/shadow and the 
> LDAP tree. However, only the LDAP tree has the supplementary group list 
> info.
> 
> In sssd-1.8.3 and earlier, issuing `getent passwd jengelh` would return 
> me all the (primary and) secondary groups I am a mamber of. Something 
> like
> 
> 	uid=25121(jengelh) gid=100(users) 
> 	groups=100(users),399(abuild),56485(friends),
> 		27072(netitwork),31327(rdesktop)
> 
> In sssd-1.8.93, this is no longer the case, and instead I get:
> 
> 	uid=25121(jengelh) gid=100(users) groups=100(users),33(video)
> 
> `getent group 31327` has to say:
> 
> 	rdesktop:*:31327:fz,mm,mk
> 
> `ldapsearch -x cn=rdesktop`:
> 
> 	dn: cn=rdesktop,ou=groups,o=borg
> 	objectClass: posixGroup
> 	objectClass: top
> 	objectClass: groupOfNames
> 	objectClass: sambaGroupMapping
> 	objectClass: zarafa-group
> 	cn: rdesktop
> 	description: Remote Desktop Users
> 	member: uid=jengelh,ou=users,o=company
> 	member: uid=fz,ou=users,o=company
> 	member: uid=mm,ou=users,o=company
> 	member: uid=mk,ou=users,o=company
> 	sambaGroupType: 2
> 	displayName: Remote Desktop
> 	gidNumber: 31327
> 	zarafaHidden: 1
> 	sambaSID: S-1-5-21-2434340325-2384729352-2357823451-12387
> 
> If I comment about my entry in /etc/passwd, I do receive the groups from 
> LDAP again, but naturally I am missing out on the local groups:
> 
> 	uid=25121(jengelh) gid=27072(netitwork) 
> 	groups=27072(netitwork),33(video),56485(friends),
> 		31327(rdesktop),399(abuild)
> 
> It seems like if the user entry is satisfiable from 
> /etc/passwd, group lookup is also only limited to passwd. This breaks
> with behavior of all previously seen implementations (pam_ldap,..)
> which strictly separated user and group lookups like NSS's design set
> forth a handful of decades ago.
> 
> 
> Side-note supplement:
> 
> And then there is the cache coming into play, which provided for a
> handful of surprises on its own. Removing the comment hash mark #
> from my entry in /etc/passwd again after the previous lookup, I then
> get *all* memberships from both local and LDAP:
> 
> 	uid=25121(jengelh) gid=100(users)
> 	groups=100(users),33(video),56485(friends),31327(rdesktop),
> 		27072(netitwork),399(abuild)
> 
> so the look-in-passwd-only "misfeature" is not even consistent :)


Remove the "initgroups: " line from /etc/nsswitch.conf, then try the
above commands again.

The Glibc people decided to push an interface break out the door without
giving anyone a heads-up. The default behavior of initgroups() has
changed to matching the first entry in the initgroups: line that has
results, instead of the old behavior of checking every entry in the
line.

See https://bugzilla.redhat.com/show_bug.cgi?id=835612 for more details.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120703/aa6f45fd/attachment.sig>


More information about the sssd-devel mailing list