[SSSD] problem with AD nested group expansion, maybe?

Greg.Lehmann at csiro.au Greg.Lehmann at csiro.au
Wed Dec 4 09:24:58 UTC 2013


> -----Original Message-----
> From: sssd-devel-bounces at lists.fedorahosted.org [mailto:sssd-devel-
> bounces at lists.fedorahosted.org] On Behalf Of steve
> Sent: Wednesday, 4 December 2013 6:20 PM
> To: sssd-devel at lists.fedorahosted.org
> Subject: Re: [SSSD] problem with AD nested group expansion, maybe?
> 
> On Wed, 2013-12-04 at 00:55 +0000, Greg.Lehmann at csiro.au wrote:
> > It was defined in the first message. Same machine. All I am doing is
> stopping sssd clearing cache dbs, restarting and doing some getents on
> passwd and group entries.
> >
> > > -----Original Message-----
> > > From: sssd-devel-bounces at lists.fedorahosted.org [mailto:sssd-devel-
> > > bounces at lists.fedorahosted.org] On Behalf Of Dmitri Pal
> > > Sent: Wednesday, 4 December 2013 10:04 AM
> > > To: sssd-devel at lists.fedorahosted.org
> > > Subject: Re: [SSSD] problem with AD nested group expansion, maybe?
> > >
> > > On 12/03/2013 06:38 PM, Greg.Lehmann at csiro.au wrote:
> > > > I'm using the standard SLES OS 1.9.4 packages. I may get time,
> but
> > > it's unlikely, to build newer versions.
> > > >
> > > > The nesting is shallow:
> > > >
> > > > Group1 contains group2, group3 group4, user1, user2, user3
> > > > Group2 contains user4, user5, user6
> > > > Group3 contains user7, user8, user9
> > > > Group4 contains user10,user11,user12
> > > >
> > > > So what is happening is that sometimes, getent group1 is
> returning
> > > just user1,user2,user3 and other times it returns all 12 users.
> > > Greg,
> > >
> > > Please define "sometimes"?
> > > Same machine or different machines? I mean does it work from some
> > > machines and does not from others or on the same machine you run at
> > > different times and you get different results?
> > > What is the state of the machine in terms of cache? Was it cleaned
> in
> > > between attempts?
> > > Is the system online or offline when you observe the issue?
> > >
> > > Since it is AD and AD requires multiple round-trips to get nested
> > > groups
> > > I might be that in your case the follow up lookups for some reason
> do
> > > not always go through.
> > >
> > > Jakub, may be it times out and SSSD thinks that there are no sub
> > > groups?
> > >
> > > >
> > > > Cheers,
> > > >
> > > > Greg
> > > >
> > > >> -----Original Message-----
> > > >> From: sssd-devel-bounces at lists.fedorahosted.org [mailto:sssd-
> devel-
> > > >> bounces at lists.fedorahosted.org] On Behalf Of Jakub Hrozek
> > > >> Sent: Tuesday, 3 December 2013 7:24 PM
> > > >> To: sssd-devel at lists.fedorahosted.org
> > > >> Subject: Re: [SSSD] problem with AD nested group expansion,
> maybe?
> > > >>
> > > >> On Tue, Dec 03, 2013 at 07:19:50AM +0000, Greg.Lehmann at csiro.au
> > > wrote:
> > > >>> I've noticed under 1.9.4 that starting with an empty cache,
> doing a
> > > >> getent group does not return all members of the group,
> sometimes.
> > > >>> The actual group in AD contains some users and some subgroups
> of
> > > >> users. Not nested deeply, but multiple subgroups...
> > > >>> If I do a
> > > >>> getent group group1
> > > >>>
> > > >>> when the cache is fresh it does not return all members. If I do
> a
> > > >> getent passwd on one of my accounts as a member of group1 and
> then
> > > >> follow that with a getent group group1 it will return all the
> > > members
> > > >> of the group. If I getent passwd account2 (also a member of
> group1)
> > > it
> > > >> does not help getent group return all members.
> > > >>> Any ideas?
> > > >>>
> 
> Hi
> We have similar (nothing deep) nesting and had similar issues on
> openSUSE with 1.9.5. It seems to be fixed on 1.11.x. It's a real pain
> to
> build and install but you could do us all a big favour by putting
> pressure on SUSE to get up to date with sssd by informing them of your
> problems with the existing version and success with a 1.11 version.
> They'll listen more to an sles user than us!
> 
> On a side note, I'm surprised that it _sometimes_ works. Are you sure
> you don't have nscd active?
> 
> Sorry this is not exactly what you want to hear but I predict that if
> you can find the time for the build, it would resolve the nesting.
> Cheers,
> Steve
> 
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

Tell you what: You get RHEL to include it and I'll push SUSE about SLES. I mean 6.5 just came out and they did not increase the version by even a minor step over 6.4! There may be more chance of a change with SLES 12 although it is likely based on opensuse and as you say that has not gotten there yet.

I think my point here is that Enterprise versions of Linux are hard to get changed.

Cheers,

Greg


More information about the sssd-devel mailing list