[SSSD-users] id, ACLs, and remote groups

Dmitri Pal dpal at redhat.com
Mon Aug 18 17:40:30 UTC 2014


On 08/18/2014 07:07 PM, Peter Kirby wrote:
> I'm running CentOS 7, fully updated with SSSD version 1.11.2.  I used 
> realm to setup SSSD and everything seems to be working fine for 
> authentication.  I'm even able to filter access based on an ldap 
> group.  My id and access providers are both set to ad.
>
> When I try to run: id username, all I get is the "domain users" group 
> listed as the primary group.  However, if I run something like: getent 
> group test-group, and then again run id on a user in that group, 
> test-group now shows up in the list along with domain users.
>
> While I don't particularly care about the output from id, I'm seeing 
> the same behavior when trying to use ACLs.  The scenario is the same 
> as above.  Before getent group test-group, the users do not have 
> access via ACL to files.  As soon as I run getent, everything starts 
> working as it should.
>
> I have tried enumerate = true in sssd.conf and confirmed sss is in 
> nsswitch.conf where it should be, but I cannot seem to make remote 
> groups work.
>
> I suspect I'm missing something very small, but I've been searching 
> manuals, google, and the logs for days and I haven't found any 
> solution yet.  I would appreciate any suggestions anyone might have.

You need to log as the user. Then all his groups will be fetched.
id command does not fetch everything because it will be too costly but 
when user logs in all his groups are fetched and all the file access is 
properly enforced.

HTH

>
> Thanks,
> Peter
>
> --
> Peter Kirby
> System and Database Administrator @ Harding University
>
>
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20140818/514d03fd/attachment.html>


More information about the sssd-users mailing list