[SSSD] problem with AD nested group expansion, maybe?

Greg.Lehmann at csiro.au Greg.Lehmann at csiro.au
Tue Dec 3 23:38:29 UTC 2013


I'm using the standard SLES OS 1.9.4 packages. I may get time, but it's unlikely, to build newer versions.

The nesting is shallow:

Group1 contains group2, group3 group4, user1, user2, user3
Group2 contains user4, user5, user6
Group3 contains user7, user8, user9
Group4 contains user10,user11,user12

So what is happening is that sometimes, getent group1 is returning just user1,user2,user3 and other times it returns all 12 users.

Cheers,

Greg

> -----Original Message-----
> From: sssd-devel-bounces at lists.fedorahosted.org [mailto:sssd-devel-
> bounces at lists.fedorahosted.org] On Behalf Of Jakub Hrozek
> Sent: Tuesday, 3 December 2013 7:24 PM
> To: sssd-devel at lists.fedorahosted.org
> Subject: Re: [SSSD] problem with AD nested group expansion, maybe?
> 
> On Tue, Dec 03, 2013 at 07:19:50AM +0000, Greg.Lehmann at csiro.au wrote:
> > I've noticed under 1.9.4 that starting with an empty cache, doing a
> getent group does not return all members of the group, sometimes.
> >
> > The actual group in AD contains some users and some subgroups of
> users. Not nested deeply, but multiple subgroups...
> >
> > If I do a
> > getent group group1
> >
> > when the cache is fresh it does not return all members. If I do a
> getent passwd on one of my accounts as a member of group1 and then
> follow that with a getent group group1 it will return all the members
> of the group. If I getent passwd account2 (also a member of group1) it
> does not help getent group return all members.
> >
> > Any ideas?
> >
> > Cheers,
> >
> > Greg Lehmann
> 
> If you're running upstream tarballs, can you try 1.9.6 ?
> 
> There's been a number of fixes between .4 and .6 that might be
> relevant.
> 
> btw is the member deeply nested? Please note that the default member
> nesting limit is 2 (see ldap_group_nesting_level).
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel


More information about the sssd-devel mailing list