[SSSD-users] id, ACLs, and remote groups

Peter Kirby lpkirby at harding.edu
Mon Aug 18 17:07:30 UTC 2014


I'm running CentOS 7, fully updated with SSSD version 1.11.2.  I used realm
to setup SSSD and everything seems to be working fine for authentication.
 I'm even able to filter access based on an ldap group.  My id and access
providers are both set to ad.

When I try to run: id username, all I get is the "domain users" group
listed as the primary group.  However, if I run something like: getent
group test-group, and then again run id on a user in that group, test-group
now shows up in the list along with domain users.

While I don't particularly care about the output from id, I'm seeing the
same behavior when trying to use ACLs.  The scenario is the same as above.
 Before getent group test-group, the users do not have access via ACL to
files.  As soon as I run getent, everything starts working as it should.

I have tried enumerate = true in sssd.conf and confirmed sss is in
nsswitch.conf where it should be, but I cannot seem to make remote groups
work.

I suspect I'm missing something very small, but I've been searching
manuals, google, and the logs for days and I haven't found any solution
yet.  I would appreciate any suggestions anyone might have.

Thanks,
Peter

--
Peter Kirby
System and Database Administrator @ Harding University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20140818/a1f7cf83/attachment.html>


More information about the sssd-users mailing list