[SSSD-users] override_homedir , GUIDs problem

Jakub Hrozek jhrozek at redhat.com
Thu Feb 28 10:33:17 UTC 2013


On Wed, Feb 27, 2013 at 01:36:58PM +0000, Longina Przybyszewska wrote:
> 
> On Wed, Feb 27, 2013 at 10:11:03AM +0000, Longina Przybyszewska wrote:
> 
> > ------------------
> > Another problem - with group IDs:
> > 
> > After login to the terminal, I get the long list  of warnings for all 
> > groups 1172xxxxx - it really delays login, as the list is long. Do I miss some config options ?
> > 
> > su - testuser
> > ...
> > groups: cannot find name for group ID XXXXXXX ...
> > 
> 
> >>That's quite suspicious. How deep is your nesting structure? Are the groups that you only see numbers for two or more levels deep? The only known bug that could be related is
> >>https://fedorahosted.org/sssd/ticket/1755
> 
> >>can you try setting ldap_group_nesting_level to a higher number to check if the issue is resolved?
> 
> How can I find out about the nesting structure in AD?
> 
> I tried with nesting_level 3|4|5
> 
> It doesn't help for login issue - the same long list for all nesting levels of from command
> 
>  su - testuser
> 
> 
> The   number of groups listed in  'id ' command changes with 'nesting_level': 
> 
> (Nesting level =5)
> alongina at victoria:~$ id -G testuser
> 332400513
> alongina at victoria:~$ id -G -n testuser
> domain users
> alongina at victoria:~$ id testuser
> uid=332405654(testuser) gid=332400513(domain users) groups=332400513(domain users)
> 
> (nesting level=4)
> 
> alongina at victoria:~$ id -G testuser
> 332400513 332411734 332411220 332411221 332405659 332410635 332403786 332403699 332407177 332408204 332408312 332406100 332408307 332413664 332402685 332402830 332411184
> alongina at victoria:~$ id -G -n testuser
> domain users data-nat-nat-it-groupdrive rw nat-fnc-pri-setdiscription nat-pri-setcomputerdesc imada-terminal-users nat-it-outlook-admin nat-terminal-users terminal brugere dl-nat-it-staff nat-it-ansatte nat-it-ad-hoc nat-esignatur dl-nat-it nat-ctxusers common_users nat-lectures nat-booking
> alongina at victoria:~$ id testuser
> uid=332405654(longina) gid=332400513(domain users) groups=332400513(domain users),332411734(data-nat-nat-it-groupdrive rw),332411220(nat-fnc-pri-setdiscription),332411221(nat-pri-setcomputerdesc),332405659(imada-terminal-users),332410635(nat-it-outlook-admin),332403786(nat-terminal-users),332403699(terminal brugere),332407177(dl-nat-it-staff),332408204(nat-it-ansatte),332408312(nat-it-ad-hoc),332406100(nat-esignatur),332408307(dl-nat-it),332413664(nat-ctxusers),332402685(common_users),332402830(nat-lectures),332411184(nat-booking)
> 
> 
> It  depends somehow on cache.
> Just after emptying cache I  get the very long listing.
> 
> root at victoria:/var/lib/sss/db# service sssd stop
> sssd stop/waiting
> root at victoria:/var/lib/sss/db# \rm -rf *
> root at victoria:/var/lib/sss/db# service sssd start
> sssd start/running, process 3635
> root at victoria:/var/lib/sss/db# id testuser
> uid=332405654(testuser) gid=332400513(domain users) groups=332400513(doma
> in users),332402685(common_users),1172668083,1172671850,1172626924,11726
> 70697,1172632585,1172657894,1172647528,1172673996,1172630281,1172650784,
> 1172649006,1172646018,1172626637,1172668082,1172647518,332406100(nat-esi
> gnatur),332403786(nat-terminal-users),1172647527,332405659(imada-termina
> l-users),1172647519,1172671034,1172652129,1172650787,1172608193,11726460
> 19,1172649007,1172645844,1172630472,1172648739,1172645167,332402830(nat-
> lectures),1172649004,1172649400,1172671853,1172650786,332408307(dl-nat-i
> t),1172645166,1172645845,988802256,1172651920,1172649005,1172659655,1172
> 606592,1172647852,1172633504,1172667765,1172666809,1172645842,1172649046
> ,1172667764,1172647523,1172626846,1172633505,1172645161,1172658369,11726
> 45843,1172616454,1172607216,332411221(nat-pri-setcomputerdesc),117265924
> 9,332410635(nat-it-outlook-admin),1172645163,1172644173,1172670698,98880
> 3287,1172645162,1172645841,1172659248,1172666810,1172659262,1172626838,1
> 172647520,988807606,1172626843,332411220(nat-fnc-pri-setdiscription),117
> 2612780,1172649045,1172645152,1172645147,1172626938,1172658370,117265836
> 5,1172630586,1172649398,1172627322,332413664(nat
> -ctxusers),1172607213,1172626943,1172649060,1172681172,332408204(nat-it-ansatte),1172632583,1172658364,1172626827,332407177(dl-nat-it-staff),1172658371,1172653861,1172645344,332403699(terminal brugere),1172649061,1172645146,1172632578,1172671847,1172626940,1172626841,1172648741,1172649062,1172632579,1172658363,1172627278,1172645150,1172653860,332411184(nat-booking),332408312(nat-it-ad-hoc),1172632582,1172645145,1172671028,1172645144,1172627767,1172626935,1172632581,1172672165,1172645151,1172671032,332411734(data-nat-nat-it-groupdrive rw),1172657810,1172612322,1172650789,1172648253,1172657811,1172681132,1172648254,1172649064,1172627766,1172645974,1172672164,1172671286,1172632580,1172648736,1172679679,1172622933,1172679716,1172645975,1172671030,1172620701,1172681776,1172650191,1172648735
> 
> The same command issued immediately again produces different output:
>  
> id testuser
> uid=332405654(testuser) gid=332400513(domain users) groups=332400513(domain users),1172649061,1172649062,1172649064,1172650191,1172650789,1172651920,1172653860,1172653861,1172657810,1172657811,1172657894,1172658363,1172658371,1172668083,1172670697,1172671028,1172671030,1172671032,1172671286,1172671847,1172671850,1172672164,1172672165,1172679679,1172679716,1172681132,1172681776,332411734(data-nat-nat-it-groupdrive rw),332411220(nat-fnc-pri-setdiscription),332411221(nat-pri-setcomputerdesc),332405659(imada-terminal-users),332410635(nat-it-outlook-admin),332403786(nat-terminal-users),332403699(terminal brugere),332407177(dl-nat-it-staff),332408204(nat-it-ansatte),332408312(nat-it-ad-hoc),332406100(nat-esignatur),332408307(dl-nat-it),332413664(nat-ctxusers),332402685(common_users),332402830(nat-lectures),332411184(nat-booking)
> 
> 
> Longina

OK, this sounds like some kind of a bug.

Can you try removing all caches,
including the memory cache (rm -f /var/lib/sss/db/cache_*.ldb
/var/lib/sss/mc/*), raise debugging in the [domain] section and attach
/var/log/sssd/sssd_$domain.log ? That should help identify why we are
not resolving all the gids.


More information about the sssd-users mailing list