[SSSD] problem with AD nested group expansion, maybe?

Greg.Lehmann at csiro.au Greg.Lehmann at csiro.au
Wed Dec 4 00:55:21 UTC 2013


It was defined in the first message. Same machine. All I am doing is stopping sssd clearing cache dbs, restarting and doing some getents on passwd and group entries.

> -----Original Message-----
> From: sssd-devel-bounces at lists.fedorahosted.org [mailto:sssd-devel-
> bounces at lists.fedorahosted.org] On Behalf Of Dmitri Pal
> Sent: Wednesday, 4 December 2013 10:04 AM
> To: sssd-devel at lists.fedorahosted.org
> Subject: Re: [SSSD] problem with AD nested group expansion, maybe?
> 
> On 12/03/2013 06:38 PM, Greg.Lehmann at csiro.au wrote:
> > I'm using the standard SLES OS 1.9.4 packages. I may get time, but
> it's unlikely, to build newer versions.
> >
> > The nesting is shallow:
> >
> > Group1 contains group2, group3 group4, user1, user2, user3
> > Group2 contains user4, user5, user6
> > Group3 contains user7, user8, user9
> > Group4 contains user10,user11,user12
> >
> > So what is happening is that sometimes, getent group1 is returning
> just user1,user2,user3 and other times it returns all 12 users.
> Greg,
> 
> Please define "sometimes"?
> Same machine or different machines? I mean does it work from some
> machines and does not from others or on the same machine you run at
> different times and you get different results?
> What is the state of the machine in terms of cache? Was it cleaned in
> between attempts?
> Is the system online or offline when you observe the issue?
> 
> Since it is AD and AD requires multiple round-trips to get nested
> groups
> I might be that in your case the follow up lookups for some reason do
> not always go through.
> 
> Jakub, may be it times out and SSSD thinks that there are no sub
> groups?
> 
> >
> > Cheers,
> >
> > Greg
> >
> >> -----Original Message-----
> >> From: sssd-devel-bounces at lists.fedorahosted.org [mailto:sssd-devel-
> >> bounces at lists.fedorahosted.org] On Behalf Of Jakub Hrozek
> >> Sent: Tuesday, 3 December 2013 7:24 PM
> >> To: sssd-devel at lists.fedorahosted.org
> >> Subject: Re: [SSSD] problem with AD nested group expansion, maybe?
> >>
> >> On Tue, Dec 03, 2013 at 07:19:50AM +0000, Greg.Lehmann at csiro.au
> wrote:
> >>> I've noticed under 1.9.4 that starting with an empty cache, doing a
> >> getent group does not return all members of the group, sometimes.
> >>> The actual group in AD contains some users and some subgroups of
> >> users. Not nested deeply, but multiple subgroups...
> >>> If I do a
> >>> getent group group1
> >>>
> >>> when the cache is fresh it does not return all members. If I do a
> >> getent passwd on one of my accounts as a member of group1 and then
> >> follow that with a getent group group1 it will return all the
> members
> >> of the group. If I getent passwd account2 (also a member of group1)
> it
> >> does not help getent group return all members.
> >>> Any ideas?
> >>>
> >>> Cheers,
> >>>
> >>> Greg Lehmann
> >> If you're running upstream tarballs, can you try 1.9.6 ?
> >>
> >> There's been a number of fixes between .4 and .6 that might be
> >> relevant.
> >>
> >> btw is the member deeply nested? Please note that the default member
> >> nesting limit is 2 (see ldap_group_nesting_level).
> >> _______________________________________________
> >> sssd-devel mailing list
> >> sssd-devel at lists.fedorahosted.org
> >> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> 
> 
> --
> Thank you,
> Dmitri Pal
> 
> Sr. Engineering Manager for IdM portfolio
> Red Hat Inc.
> 
> 
> -------------------------------
> Looking to carve out IT costs?
> www.redhat.com/carveoutcosts/
> 
> 
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel


More information about the sssd-devel mailing list