[SSSD] Mixing passwd accounts with LDAP groups issue

Stephen Gallagher sgallagh at redhat.com
Tue Jul 3 12:20:13 UTC 2012


On Tue, 2012-07-03 at 14:17 +0200, Jan Engelhardt wrote:
> On Tuesday 2012-07-03 13:58, Stephen Gallagher wrote:
> >> In sssd-1.8.3 and earlier, issuing `getent passwd jengelh` would return 
> >> me all the (primary and) secondary groups I am a mamber of. Something 
> >> like
> >> 	uid=25121(jengelh) gid=100(users) 
> >> 	groups=100(users),399(abuild),56485(friends),
> >> 		27072(netitwork),31327(rdesktop)
> >> 
> >> In sssd-1.8.93, this is no longer the case, and instead I get:
> >> 	uid=25121(jengelh) gid=100(users) groups=100(users),33(video)
> >> 
> >> `getent group 31327` has to say:
> >> 	rdesktop:*:31327:fz,mm,mk
> >> 
> >> `ldapsearch -x cn=rdesktop`:
> >> 	[...] member: uid=jengelh,ou=users,o=company
> 
> >Remove the "initgroups: " line from /etc/nsswitch.conf, then try the
> >above commands again.
> 
> The version I am on uses glibc-2.15-725b8ee08aff.tar.xz as source.
> This tarball ships an nsswitch.conf with the questionable initgroups:
> line in its default nsswitch.conf (so I am in fact on a susceptible
> version).
> However, openSUSE never ships that and instead its own nsswitch.conf,
> so I never have had any initgroups: line and don't do so to this day.
> So all commands I executed already were without initgroups:.


Just to rule out the possibility that openSUSE's internal default was
modified to behave the way the new initgroups line does, can you set

initgroups: files [SUCCESS=continue] sss

explicitly and try that?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120703/484f1382/attachment.sig>


More information about the sssd-devel mailing list