[SSSD-users] SSSD-1.12.5 and group membership problem

Longina Przybyszewska longina at sdu.dk
Fri Aug 14 15:14:10 UTC 2015



> -----Oprindelig meddelelse-----
> Fra: sssd-users-bounces at lists.fedorahosted.org [mailto:sssd-users-
> bounces at lists.fedorahosted.org] På vegne af Jakub Hrozek
> Sendt: 14. august 2015 10:19
> Til: sssd-users at lists.fedorahosted.org
> Emne: Re: [SSSD-users] SSSD-1.12.5 and group membership problem
> 
> On Thu, Aug 13, 2015 at 04:32:12PM +0000, Longina Przybyszewska wrote:
> > Hi,
> > I have  an issue with SSSD-1.12.5 with resolving group membership.
> > Only Posix  primary group is displayed for users accounts.
> >
> > Group is visible on the system but not displayed from 'id' or 'groups'
> commands.
> >
> > getent group 30000005
> > data-adm-lnx-nfs0a-rw-id-00001:*:30000005:
> >
> > getent group data-adm-lnx-nfs0a-rw-id-00001
> > data-adm-lnx-nfs0a-rw-id-00001:*:30000005:
> >
> > id user1
> > uid=xxxxxxx(user1) gid=30000000(lnx-primary)
> > groups=30000000(lnx-primary)
> >
> > Group object has  Posix gid and is setup as universal group in realm
> A.C.DOM.ORG:
> > ...
> > gidNumber = 30000005
> > memberUid: user1, user2
> > ....
> > I have AD as id_,access_auth_provider.
> > Users have got Posix attributes in AD.
> > Computer and group objects are from the same realm: A.C.DOM.ORG.
> > User objects are in all realms: N.C.DOM.ORG, A.C.DOM.ORG, C.DOM.ORG
> >
> >
> > With my setup I can achieve:
> > - login with short names across realm
> > - access kerberized nfs homedir
> >
> > Is there a way to resolve correctly group's membership with this setup??
> 
> It's not really possible to answer without logs, but if you're looking for cross-
> domain memberships, then you need to use only one [domain] section in
> sssd.conf and let the id_provider=ad (or rather subdomain_provider=ad, but
> its value is inherited from id_provider, no need to set it explicitly) discover
> the subdomains.
> 
> What might also be problematic is using POSIX IDs -- because only the Global
> Catalog can be used to resolve cross-domain memberships at the moment
> and POSIX attributes are not normally present in GC, then maybe the safest
> way would be to modify the AD schema to replicate the attributes to GC.

You are right!
Hvis jeg laver ldap search in a.c.dom.org on GC port,   memberOf attributes are missing;
Jeg thought that if it is Univeral Group, it is replicated as it is to GC.


Actually I started with one domain in sssd.conf, (1.11.5) but couldn't get cross realm authentication  and Kerberos nfs/idmapping
to work together until I put all domains in sssd.conf . I continue this setup with 1.12.5 , after upgrade.
I have to stick to Ubuntu and sssd releases in repos.
Recently I wanted to give a chance realmd with sssd-1.12.5 again, and made setup from scratch  without success .
 The  only discovered domain with auto-build sssd.conf were the one to which machine were rolled on.

Best,
Longina


More information about the sssd-users mailing list