[SSSD] problem with AD nested group expansion, maybe?

Jakub Hrozek jhrozek at redhat.com
Tue Dec 3 09:23:44 UTC 2013


On Tue, Dec 03, 2013 at 07:19:50AM +0000, Greg.Lehmann at csiro.au wrote:
> I've noticed under 1.9.4 that starting with an empty cache, doing a getent group does not return all members of the group, sometimes.
> 
> The actual group in AD contains some users and some subgroups of users. Not nested deeply, but multiple subgroups...
> 
> If I do a
> getent group group1
> 
> when the cache is fresh it does not return all members. If I do a getent passwd on one of my accounts as a member of group1 and then follow that with a getent group group1 it will return all the members of the group. If I getent passwd account2 (also a member of group1) it does not help getent group return all members.
> 
> Any ideas?
> 
> Cheers,
> 
> Greg Lehmann

If you're running upstream tarballs, can you try 1.9.6 ?

There's been a number of fixes between .4 and .6 that might be relevant.

btw is the member deeply nested? Please note that the default member
nesting limit is 2 (see ldap_group_nesting_level).



More information about the sssd-devel mailing list