[SSSD-users] How do I view multiple users groups using sssd? [SOLVED]

Leo K unholi at hotmail.com
Mon Apr 13 14:45:24 UTC 2015


jhrozek, thank you for looking at the log fie; your recommendation helped narrow the scope in this morning's troubleshooting efforts. We also have a Red Hat engineer here for the week, and he was able to spot something in the sssd_default.log which caught his attention. Long story short, issue has been resolved.

--------------------------------
Here's what was broken:
--------------------------------

ldap_schema = rfc2307bis <---

Caused this error:

Mon Apr 13 09:54:02 2015) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(memberUid=uid=lbogus,ou=People,dc=domain,dc=com)(objectClass=posixGroup)(cn=*))][dc=domain,dc=com].

Basically 'rfc2307bis' performed group searches using the full ldap string instead of just the UID: (memberUid=uid=lbogus,ou=People,dc=domain,dc=com)

---------------------------
Here's what fixed it:
---------------------------

ldap_schema = rfc2307 <---

Resulted in the following search string:

(Mon Apr 13 10:02:06 2015) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [>>>>>(&(memberUid=lbogus)<<<<<(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))][dc=domain,dc=com].

I could have swore I initially started working 'rfc2307' and ran into issues early on using it, which is why I switched over to 'rfc2307bis' after some Google results recommended the switch. 

Thank you all for helping me out with this issue, I really appreciated the feedback and pointers.

-LeoK


> Date: Mon, 13 Apr 2015 11:16:11 +0200
> From: jhrozek at redhat.com
> To: sssd-users at lists.fedorahosted.org
> Subject: Re: [SSSD-users] How do I view multiple users groups using sssd?
> 
> This is the interesting part:
> (Fri Apr 10 16:25:52 2015) [sssd[be[default]]] [sdap_initgr_rfc2307bis_next_base] (0x0400): Searching for parent groups for user [uid=lbogus,ou=People,dc=domain,dc=com] with base [ou=Group,dc=domain,dc=com]     
> (Fri Apr 10 16:25:52 2015) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with                                                                                                  
> [(&(member=uid=lbogus,ou=People,dc=domain,dc=com)(objectClass=posixGroup)(cn=*))][ou=Group,dc=domain,dc=com].                                                                                                      
> 
> [...]
> 
> [sdap_initgr_rfc2307bis_process] (0x1000): Found 0 parent groups for user [lbogus]
> 
> So SSSD is trying to search the user groups with:
>     uid=lbogus,ou=People,dc=domain,dc=com
> 
> Can you check some of the secondary groups to see what attribute you use
> to reference group members?
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20150413/4d8a27a5/attachment.html>


More information about the sssd-users mailing list