[SSSD] problem with AD nested group expansion, maybe?

Lukas Slebodnik lslebodn at redhat.com
Thu Dec 5 08:00:46 UTC 2013


On (05/12/13 06:33), Greg.Lehmann at csiro.au wrote:
>> -----Original Message-----
>> From: sssd-devel-bounces at lists.fedorahosted.org [mailto:sssd-devel-
>> bounces at lists.fedorahosted.org] On Behalf Of Jakub Hrozek
>> Sent: Thursday, 5 December 2013 12:14 AM
>> To: sssd-devel at lists.fedorahosted.org
>> Subject: Re: [SSSD] problem with AD nested group expansion, maybe?
>> 
>> On Wed, Dec 04, 2013 at 09:24:58AM +0000, Greg.Lehmann at csiro.au wrote:
>> >
>> > > -----Original Message-----
>> > > From: sssd-devel-bounces at lists.fedorahosted.org [mailto:sssd-devel-
>> > > bounces at lists.fedorahosted.org] On Behalf Of steve
>> > > Sent: Wednesday, 4 December 2013 6:20 PM
>> > > To: sssd-devel at lists.fedorahosted.org
>> > > Subject: Re: [SSSD] problem with AD nested group expansion, maybe?
>> > >
>> > > On Wed, 2013-12-04 at 00:55 +0000, Greg.Lehmann at csiro.au wrote:
>> > > > It was defined in the first message. Same machine. All I am doing
>> is
>> > > stopping sssd clearing cache dbs, restarting and doing some getents
>> on
>> > > passwd and group entries.
>> > > >
>> > > > > -----Original Message-----
>> > > > > From: sssd-devel-bounces at lists.fedorahosted.org [mailto:sssd-
>> devel-
>> > > > > bounces at lists.fedorahosted.org] On Behalf Of Dmitri Pal
>> > > > > Sent: Wednesday, 4 December 2013 10:04 AM
>> > > > > To: sssd-devel at lists.fedorahosted.org
>> > > > > Subject: Re: [SSSD] problem with AD nested group expansion,
>> maybe?
>> > > > >
>> > > > > On 12/03/2013 06:38 PM, Greg.Lehmann at csiro.au wrote:
>> > > > > > I'm using the standard SLES OS 1.9.4 packages. I may get
>> time,
>> > > but
>> > > > > it's unlikely, to build newer versions.
>> > > > > >
>> > > > > > The nesting is shallow:
>> > > > > >
>> > > > > > Group1 contains group2, group3 group4, user1, user2, user3
>> > > > > > Group2 contains user4, user5, user6
>> > > > > > Group3 contains user7, user8, user9
>> > > > > > Group4 contains user10,user11,user12
>> > > > > >
>> > > > > > So what is happening is that sometimes, getent group1 is
>> > > returning
>> > > > > just user1,user2,user3 and other times it returns all 12 users.
>> > > > > Greg,
>> > > > >
>> > > > > Please define "sometimes"?
>> > > > > Same machine or different machines? I mean does it work from
>> some
>> > > > > machines and does not from others or on the same machine you
>> run at
>> > > > > different times and you get different results?
>> > > > > What is the state of the machine in terms of cache? Was it
>> cleaned
>> > > in
>> > > > > between attempts?
>> > > > > Is the system online or offline when you observe the issue?
>> > > > >
>> > > > > Since it is AD and AD requires multiple round-trips to get
>> nested
>> > > > > groups
>> > > > > I might be that in your case the follow up lookups for some
>> reason
>> > > do
>> > > > > not always go through.
>> > > > >
>> > > > > Jakub, may be it times out and SSSD thinks that there are no
>> sub
>> > > > > groups?
>> > > > >
>> > > > > >
>> > > > > > Cheers,
>> > > > > >
>> > > > > > Greg
>> > > > > >
>> > > > > >> -----Original Message-----
>> > > > > >> From: sssd-devel-bounces at lists.fedorahosted.org
>> [mailto:sssd-
>> > > devel-
>> > > > > >> bounces at lists.fedorahosted.org] On Behalf Of Jakub Hrozek
>> > > > > >> Sent: Tuesday, 3 December 2013 7:24 PM
>> > > > > >> To: sssd-devel at lists.fedorahosted.org
>> > > > > >> Subject: Re: [SSSD] problem with AD nested group expansion,
>> > > maybe?
>> > > > > >>
>> > > > > >> On Tue, Dec 03, 2013 at 07:19:50AM +0000,
>> Greg.Lehmann at csiro.au
>> > > > > wrote:
>> > > > > >>> I've noticed under 1.9.4 that starting with an empty cache,
>> > > doing a
>> > > > > >> getent group does not return all members of the group,
>> > > sometimes.
>> > > > > >>> The actual group in AD contains some users and some
>> subgroups
>> > > of
>> > > > > >> users. Not nested deeply, but multiple subgroups...
>> > > > > >>> If I do a
>> > > > > >>> getent group group1
>> > > > > >>>
>> > > > > >>> when the cache is fresh it does not return all members. If
>> I do
>> > > a
>> > > > > >> getent passwd on one of my accounts as a member of group1
>> and
>> > > then
>> > > > > >> follow that with a getent group group1 it will return all
>> the
>> > > > > members
>> > > > > >> of the group. If I getent passwd account2 (also a member of
>> > > group1)
>> > > > > it
>> > > > > >> does not help getent group return all members.
>> > > > > >>> Any ideas?
>> > > > > >>>
>> > >
>> > > Hi
>> > > We have similar (nothing deep) nesting and had similar issues on
>> > > openSUSE with 1.9.5. It seems to be fixed on 1.11.x. It's a real
>> pain
>> > > to
>> > > build and install but you could do us all a big favour by putting
>> > > pressure on SUSE to get up to date with sssd by informing them of
>> your
>> > > problems with the existing version and success with a 1.11 version.
>> > > They'll listen more to an sles user than us!
>> > >
>> > > On a side note, I'm surprised that it _sometimes_ works. Are you
>> sure
>> > > you don't have nscd active?
>> > >
>> > > Sorry this is not exactly what you want to hear but I predict that
>> if
>> > > you can find the time for the build, it would resolve the nesting.
>> > > Cheers,
>> > > Steve
>> > >
>> > >
>> > > _______________________________________________
>> > > sssd-devel mailing list
>> > > sssd-devel at lists.fedorahosted.org
>> > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>> >
>> > Tell you what: You get RHEL to include it and I'll push SUSE about
>> SLES. I mean 6.5 just came out and they did not increase the version by
>> even a minor step over 6.4! There may be more chance of a change with
>> SLES 12 although it is likely based on opensuse and as you say that has
>> not gotten there yet.
>> 
>> btw if you have RHEL6.5 handy, can you check if you see the same issue
>> there?
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
>CentOS 6.5 does not have the same issue, but does have an issue with getting all the group members right.
>
>I am seeing all group members but sometimes I am seeing one member appear twice as this member exists at the top level as well as in a sub group. Apart from that it looks good.
We would like to fix it.
Could you file a ticket? https://fedorahosted.org/sssd/newticket
Log files with high debug level will be very useful for analysis of
this problem.

LS



More information about the sssd-devel mailing list