<div dir="ltr">That's for the quick response. Unfortunately, that's not the behavior I'm seeing. Here's what I see:<div><br></div><div>1) Log in as root, erase the cache, and restart SSSD.</div><div>2) Log in as the user and try a "touch test" in a directory controlled by ACL.</div>
<div>3) Get permission denied error.</div><div>4) As the user (root does not have to do this) run: getent group test-group which shows the correct membership from Active Directory.</div><div>5) Attempt another "touch test", still permission denied.</div>
<div>6) Log out and then log back in.</div><div>7) One more "touch test" and it works.</div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div dir="ltr"><div>--</div>Peter Kirby<br><span style="font-family:Arial;font-size:13px;white-space:pre-wrap">System and Database Administrator</span> @ Harding University<br>
</div></div>
<br><br><div class="gmail_quote">On Mon, Aug 18, 2014 at 12:40 PM, Dmitri Pal <span dir="ltr"><<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF"><div><div class="h5">
<div>On 08/18/2014 07:07 PM, Peter Kirby
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">I'm running CentOS 7, fully updated with SSSD
version 1.11.2. I used realm to setup SSSD and everything seems
to be working fine for authentication. I'm even able to filter
access based on an ldap group. My id and access providers are
both set to ad.
<div>
<br>
</div>
<div>When I try to run: id username, all I get is the "domain
users" group listed as the primary group. However, if I run
something like: getent group test-group, and then again run id
on a user in that group, test-group now shows up in the list
along with domain users.</div>
<div><br>
</div>
<div>While I don't particularly care about the output from id,
I'm seeing the same behavior when trying to use ACLs. The
scenario is the same as above. Before getent group
test-group, the users do not have access via ACL to files. As
soon as I run getent, everything starts working as it should.</div>
<div><br>
</div>
<div>I have tried enumerate = true in sssd.conf and confirmed
sss is in nsswitch.conf where it should be, but I cannot seem
to make remote groups work.</div>
<div><br>
</div>
<div>I suspect I'm missing something very small, but I've been
searching manuals, google, and the logs for days and I haven't
found any solution yet. I would appreciate any suggestions
anyone might have.</div>
</div>
</blockquote>
<br></div></div>
You need to log as the user. Then all his groups will be fetched.<br>
id command does not fetch everything because it will be too costly
but when user logs in all his groups are fetched and all the file
access is properly enforced.<br>
<br>
HTH<br>
<br>
<blockquote type="cite"><div class="">
<div dir="ltr">
<div><br>
</div>
<div>Thanks,</div>
<div>Peter</div>
<div><br>
<div>
<div>
<div dir="ltr">
<div>--</div>
Peter Kirby<br>
<span style="font-family:Arial;font-size:13px;white-space:pre-wrap">System
and Database Administrator</span> @ Harding University<br>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset></fieldset>
<br>
</div><pre>_______________________________________________
sssd-users mailing list
<a href="mailto:sssd-users@lists.fedorahosted.org" target="_blank">sssd-users@lists.fedorahosted.org</a>
<a href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a><span class="HOEnZb"><font color="#888888">
</font></span></pre><span class="HOEnZb"><font color="#888888">
</font></span></blockquote><span class="HOEnZb"><font color="#888888">
<br>
<br>
<pre cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</font></span></div>
<br>_______________________________________________<br>
sssd-users mailing list<br>
<a href="mailto:sssd-users@lists.fedorahosted.org">sssd-users@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a><br>
<br></blockquote></div><br></div>