[SSSD] user and group precedence issue
Stephen Gallagher
sgallagh at redhat.com
Wed Mar 14 13:08:31 UTC 2012
On Wed, 2012-03-14 at 13:55 +0100, Olivier wrote:
> Hello,
>
> I have configure redhat (6 and 5) boxes to authenticate users
> over an openldap server via sssd. I have implemented a policy
> so that "Systems" accounts ( uid > 500 ) are not in ldap but
> authentified over local password db.
>
> My ldap directory also contains posixgroups that I use to
> tune some accesses ( using /etc/security/access.conf ).
>
> I have added this in my nsswitch.conf :
>
> passwd: files sss
> shadow: files sss
> group: sss files
>
> I have configured sss as a primary source of information
> for groups, because I would like pam to take into account
> both groups that are declared in ldap and those that are
> locally configured (even for system accounts that don't have
> any entry in ldap).
>
> The problem I'm facing is that ldap groups for a user are only
> considered if the user has itself an entry in ldap ( except if
> th user is declared as having an ldap group as primary in
> /etc/passwd ).
>
> Here is an example :
>
> If I have this in /etc/passwd :
> ntp:x:38:38::/etc/ntp:/sbin/sh
>
> This in /etc/groups
> ntp:x:38:
>
> And this group in ldap :
>
> dn: cn=sysgrp,ou=group,dc=example,dc=fr
> cn: sysgrp
> gidnumber: 18010
> memberuid: ntp
> memberuid: wheel
> memberuid: ldap
> objectclass: posixGroup
>
> Then a "su - ntp -c groups" returns only "ntp" group not "sysgrp" :
>
> $ su - ntp -c groups
> ntp
>
> If I create a user entry for "ntp" in ldap directory, then it works :
>
> # Entry :
> dn: uid=ntp,ou=sysaccounts,ou=people,dc=example,dc=fr
> cn: ntp
> gidnumber: 18010
> objectclass: top
> objectclass: person
> objectclass: organizationalPerson
> objectclass: inetOrgPerson
> objectclass: posixAccount
> uid: ntp
> uidnumber: 38
> ...
>
> I have then what I want on the client machine :
>
> $ su - ntp -c groups
> ntp sysgrp
>
> I don't want to maintain a DIT in ldap to list system accounts,
> I would only like to maintain a posix group entry that lists system
> accounts ( and match if the system account exist on the client ).
>
> Is there any way to do that ?
>
> May be someone could help me or indicate a documentation or
> a mailing list that I could try to consult to deal with that problem ?
You're experiencing the behavior described in:
https://fedorahosted.org/sssd/ticket/1020
Right now, this is a limitation of SSSD. We're currently scheduled to
look into that in the SSSD 1.11 timeframe (due in roughly nine months).
In general, it's a very rare case, as most deployments choose not to
maintain local user accounts in centrally-managed groups; they instead
move those accounts to be also centrally-managed.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120314/fc49f03d/attachment.sig>
More information about the sssd-devel
mailing list