[SSSD-users] SSSD with AD provider - can't obtain group information in subdomain

Jakub Hrozek jhrozek at redhat.com
Mon Jul 28 09:48:00 UTC 2014


On Mon, Jul 28, 2014 at 06:27:55PM +0900, 杉山昌治 wrote:
> Hello
> 
> I'm struggle with configuration of sssd to retrieve group information
> defined in a subdomain.
> I would have your support to solve my issue.

Hi,

thanks for the detailed e-mail. See some answers inline..

> 
> Here is my AD configuration. There are 3 AD servers.
> 
> Root Domain    labroot.example.com (just for top AD management)
> Sub Domain    labsso.labroot.example.com (user, global group and universal
> group are defined here)
> Subsub Domain    labbu.labsso.labroot.example.com (local domain group is
> defined here)
> 
> I created a user and groups in those AD servers as below.
> 
> User/Groups in Domain sso.example.com
> ========================
> User    test_user (MemberOf=G-Group-Server)
> Group    G-Role-ISOps-Server (Type: Global Group, Members=test_user,
> MemberOf=U-Role-ISOps-Server)
> Group    U-Role-ISOps-Server (Type: Universal Group,
> Members=G-Role-ISOps-Server)
> 
> User/Groups in Domain sso.example.com
> ========================
> Group    D-Role-Server (Type: Domain Local Group,
> Members=U-Role-ISOps-Server)

Domain-local groups are only visible in the dame domain as the client is
enrolled with. So if your domain-local groups is defined in
labbu.labsso.labroot.example.com, only clients enrolled to that domain
will be able to see that group.

See also:
    https://fedorahosted.org/sssd/ticket/2178

> 
> As for SSSD, I tried to use both "1.11.6" and "1.12.1" with "AD provider"
> as backend.
> 
> I expected to get all groups (G-Role-ISOps-Server, U-Role-ISOps-Server and
> D-ISOps-Server) as a result of
> "id test_user" command.
> But I could not find domain local group (D-Role-ISOps-Server) in groups of
> the user "test_user".
> as the result of "id test_user" command.
> I also could not find any members as the result of "getent group
> D-Role-ISOps-Server" command.
> I tried to use single domain (sso-ad-ad) and multiple domains (sso-ad-ad
> and bu-ad-ad) in sssd configuration, but the result is the almost same.
> (when I use sso-ad-ad domain only, I could not get anything as result of
> "getent group d-role-isops-server").

The right way to configure sssd would be to only use one domain section
in sssd.conf, with the domain your client was enrolled with.

> 
> # id test_user
> uid=638201126(test_user) gid=638200513(domain users)
> groups=638200513(domain
> users),638201113(g-role-server),638201118(u-role-server),638200512(domain
> admins)
> 
> # getent group d-role-isops-server
> d-role-isops-server:*:927601110:
> 
> I'm not sure how SSSD AD provider searches group information based on
> members/memberOf attributes, I suspect missing "memberOf" in universal
> group (U-Role-*) and "member of domain local group" (U-Role-ISOps-Server)
> is out of scope of LABBU domain might be clue of my issue.
> Please advise me what's wrong on my configuration and resolution of my
> issue.

By default, SSSD reads the tokenGroups attribute that contains the list
of SIDs the user is a member of. You can disable this optimization and
fall back to member/memberof processing by using the configuration
option "ad_enable_gc = False".

Is the only group that was missing from the output the domain-local one?
If so, I believe sssd is actually working as expected..

> 
> Thanks in advance.
> Shoji
> 
> 
> *** Configurations and LDAP search results ***
> 
> sssd.conf file
> ==========
> [sssd]
> config_file_version = 2
> services = nss, pam
> domains = sso-ad-ad, bu-ad-ad
> # domains = sso-ad-ad
> [nss]
> fallback_homedir = /home/SSO/%u
> default_shell = /bin/bash
> [pam]
> [domain/sso-ad-ad]
> id_provider = ad
> auth_provider = ad
> access_provider = ad
> ad_server = jpbw0-in00-is82.labsso.labroot.isops.example.com
> ad_hostname =  jpbw0-in00-is82.labsso.labroot.isops.example.com
> ldap_schema = ad

You don't have to specify ldap-schema=ad yourself, it's already the
default.

> ad_enable_gc = true

This is the default also.

> ldap_id_mapping = true

Again, this is the default.

> debug_level = 1
> [domain/bu-ad-ad]
> id_provider = ad
> auth_provider = ad
> chpass_provider = ad
> ad_server = jpbw0-in00-is81.labbu.labsso.labroot.isops.example.com
> ad_hostname =  jpbw0-in00-is81.labbu.labsso.labroot.isops.example.com
> ldap_id_mapping = true
> debug_level = 1
> 
> LDAP Search in Global Catalog of LABSSO
> ==================================
> I can search the domain local group in the global catalog.
> 
> [root at jpbl0-in00-is11 providers]# ldapsearch  -Y GSSAPI -LLL -H "ldap://
> jpbw0-in00-is82.labsso.labroot.isops.example.com:3268" -b
> "DC=labsso,DC=labroot,DC=isops,DC=example,DC=com"
> "(&(name=d-role-isops-server)(objectclass=group)(name=*))"
> SASL/GSSAPI authentication started
> SASL username: host/
> jpbl0-in00-is11.lab.isops.ibm.com at LABSSO.LABROOT.ISOPS.EXAMPLE.COM
> SASL SSF: 56
> SASL data security layer installed.
> dn:
> CN=D-Role-ISOps-Server,OU=BU0-ISOps,OU=Roles,DC=labbu,DC=labsso,DC=labroot,DC=isops,DC=example,DC=com
> objectClass: top
> objectClass: group
> cn: D-Role-ISOps-Server
> description: Server Team
> distinguishedName:
> CN=D-Role-ISOps-Server,OU=BU0-ISOps,OU=Roles,DC=labbu,DC=labsso,DC=labroot,DC=isops,DC=example,DC=com
> instanceType: 0
> whenCreated: 20131029185150.0Z
> whenChanged: 20131029185448.0Z
> uSNCreated: 17964
> uSNChanged: 18034
> name: D-Role-ISOps-Server
> objectGUID:: YflnJQk4IUK4YUAHO43J6w==
> objectSid:: AQUAAAAAAAUVAAAAml0mRju+InNXWri7VgQAAA==
> sAMAccountName: D-Role-ISOps-Server
> sAMAccountType: 536870912
> groupType: -2147483644
> objectCategory:
> CN=Group,CN=Schema,CN=Configuration,DC=labroot,DC=isops,DC=example,DC=com
> dSCorePropagationData: 16010101000000.0Z
> 
> 
> LDAP Search in LABSSO
> ====================
> I can not search the domain local group in normal domain.
> 
> [root at jpbl0-in00-is11]# ldapsearch  -Y GSSAPI -LLL -H "ldap://
> jpbw0-in00-is82.labsso.labroot.isops.example.com" -b
> "DC=labsso,DC=labroot,DC=isops,DC=example,DC=com"
> "(&(name=d-role-isops-server)(objectclass=group)(name=*))"
> SASL/GSSAPI authentication started
> SASL username: host/
> jpbl0-in00-is11.lab.isops.example.com at LABSSO.LABROOT.ISOPS.EXAMPLE.COM
> SASL SSF: 56
> SASL data security layer installed.
> # refldap://
> labbu.labsso.labroot.isops.example.com/DC=labbu,DC=labsso,DC=labroot,
>  DC=isops,DC=example,DC=com
> 
> # refldap://
> DomainDnsZones.labsso.labroot.isops.example.com/DC=DomainDnsZones,DC=
>  labsso,DC=labroot,DC=isops,DC=example,DC=com

> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users



More information about the sssd-users mailing list