I have a ubuntu system running IPA client. I am able to log in via ssh using IPA users, but I do not get any group memberships or sudo rules. Same configuration works on a different system (running CentOS).
sssd domain log output shows that the groups are retrieved from server successfully: (Fri May 22 07:04:37 2015) [sssd[be[ipa.*]]] [hbac_eval_user_element] (0x1000): Added group [admins] for user [nkrzalic] (Fri May 22 07:04:37 2015) [sssd[be[ipa.*]]] [hbac_eval_user_element] (0x1000): Added group [ipausers] for user [nkrzalic] (Fri May 22 07:04:37 2015) [sssd[be[ipa.*]]] [hbac_eval_user_element] (0x1000): Added group [editors] for user [nkrzalic] (Fri May 22 07:04:37 2015) [sssd[be[ipa.*]]] [hbac_eval_user_element] (0x1000): Added group [trust admins] for user [nkrzalic] (Fri May 22 07:04:37 2015) [sssd[be[ipa.*]]] [hbac_eval_user_element] (0x1000): Added group [devops_team] for user [nkrzalic] (Fri May 22 07:04:37 2015) [sssd[be[ipa.*]]] [hbac_eval_user_element] (0x1000): Added group [dev_team] for user [nkrzalic] (Fri May 22 07:04:37 2015) [sssd[be[ipa.*]]] [hbac_eval_user_element] (0x1000): Added group [sys_team] for user [nkrzalic] However, these groups are not shown on the user upon login: nkrzalic@ircsrv1:~$ id uid=281200051(nkrzalic) gid=281200051(nkrzalic) groups=281200051(nkrzalic) I tried cleaning sssd cache but that didn't help. sssd conf is as follows: [sssd] services = nss, pam, ssh, sudo config_file_version = 2 nsswitch.conf seems to be correct as well: # /etc/nsswitch.conf passwd: compat sss group: compat sss shadow: compat hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis sss sudoers: files sss Interestingly after I do "getent group devops_team" this group shows up: nkrzalic@ircsrv1:~$ id uid=281200051(nkrzalic) gid=281200051(nkrzalic) groups=281200051(nkrzalic),281200001(devops_team) nkrzalic@ircsrv1:~$ Any ideas? -- Regards, Nikola Kržalić. -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
