[SSSD-users] nss_cmd_initgroups searching only one ldap domain

Zachary Hanson-Hart zachhh at temple.edu
Fri Feb 22 22:39:01 UTC 2013


I have an LDAP server that is configured to serve up groups, and only
groups, using the rfc2307 schema.  I have available to me a separate ldap
authentication server.  I want sssd to get identity information from both
sources.  It is not possible to just put the groups into the existing
server, as "they" will not grant me write access nor will they agree to
manage the groups.

sssd.conf is set up with two domains.  The first (ldapr) is both auth and
id provider.  The second (groupldap) is simply an id provider (with
auth_provider=none).

The problem is that initgroups() only seems to be running for the first
domain.

In the first domain, gidNumber = uidNumber but there is no group with this
gidNumber.

The groupldap DOES have a group with this gidNumber.  It is successfully
obtained with the nss_cmd_getgrgid_search call before the initgroups call
finishes for USERNAME at ldapr.

The information flow is basically:
Issue initgroups for ALL
begin initgroups for ldapr
get missing information from groupldap
complete initgroups for ldapr

Here, it seems to me that it should continue with an initgroups for
groupldap.  It does not.

There are other groups on groupldap that have memberUid=USERNAME.  There is
never any search for groups with memberUid=USERNAME coming from the server
(in the logs on the ldap server, or in the sssd logs), and initgroups is
never called on the second domain (groupldap).

To make things more confusing, if I:
getent -s sss group SOMEGROUP
I get:
SOMEGROUP:*:12345:USERNAME:otheruser:...

where SOMEGROUP is a posixGroup on groupldap.

So, it CAN get the group information from the groupldap domain, but it
doesn't.

Is this a bug, or the expected behavior?  If this is expected, how do you
get it to search both?

Any help would be greatly appreciated.

-Zach
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20130222/7b040426/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sssd.conf
Type: application/octet-stream
Size: 985 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20130222/7b040426/attachment-0002.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sssd_nss.log.snip
Type: application/octet-stream
Size: 13352 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20130222/7b040426/attachment-0003.obj>


More information about the sssd-users mailing list