[SSSD-users] id, ACLs, and remote groups

Peter Kirby lpkirby at harding.edu
Mon Aug 18 19:38:02 UTC 2014


That's for the quick response.  Unfortunately, that's not the behavior I'm
seeing.  Here's what I see:

1) Log in as root, erase the cache, and restart SSSD.
2) Log in as the user and try a "touch test" in a directory controlled by
ACL.
3) Get permission denied error.
4) As the user (root does not have to do this) run: getent group test-group
which shows the correct membership from Active Directory.
5) Attempt another "touch test", still permission denied.
6) Log out and then log back in.
7) One more "touch test" and it works.


--
Peter Kirby
System and Database Administrator @ Harding University


On Mon, Aug 18, 2014 at 12:40 PM, Dmitri Pal <dpal at redhat.com> wrote:

>  On 08/18/2014 07:07 PM, Peter Kirby wrote:
>
> I'm running CentOS 7, fully updated with SSSD version 1.11.2.  I used
> realm to setup SSSD and everything seems to be working fine for
> authentication.  I'm even able to filter access based on an ldap group.  My
> id and access providers are both set to ad.
>
>  When I try to run: id username, all I get is the "domain users" group
> listed as the primary group.  However, if I run something like: getent
> group test-group, and then again run id on a user in that group, test-group
> now shows up in the list along with domain users.
>
>  While I don't particularly care about the output from id, I'm seeing the
> same behavior when trying to use ACLs.  The scenario is the same as above.
>  Before getent group test-group, the users do not have access via ACL to
> files.  As soon as I run getent, everything starts working as it should.
>
>  I have tried enumerate = true in sssd.conf and confirmed sss is in
> nsswitch.conf where it should be, but I cannot seem to make remote groups
> work.
>
>  I suspect I'm missing something very small, but I've been searching
> manuals, google, and the logs for days and I haven't found any solution
> yet.  I would appreciate any suggestions anyone might have.
>
>
> You need to log as the user. Then all his groups will be fetched.
> id command does not fetch everything because it will be too costly but
> when user logs in all his groups are fetched and all the file access is
> properly enforced.
>
> HTH
>
>
>  Thanks,
> Peter
>
>   --
> Peter Kirby
> System and Database Administrator @ Harding University
>
>
> _______________________________________________
> sssd-users mailing listsssd-users at lists.fedorahosted.orghttps://lists.fedorahosted.org/mailman/listinfo/sssd-users
>
>
>
> --
> Thank you,
> Dmitri Pal
>
> Sr. Engineering Manager IdM portfolio
> Red Hat, Inc.
>
>
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20140818/b607023a/attachment.html>


More information about the sssd-users mailing list