Hello,

We are having a problem with HBAC that appears to be related to group 
membership lookup.  I am testing with a new install on RHEL 7.2 with a 
cross-forest trust with AD.  When an AD user attempts to log into a client (RH 
6.7 or 7.2) the "hbac_eval_user_element" can report a different number of 
groups each time and never seems to contain the full list.  For the testing 
account, running the 'id' command returns 153 groups.  The ipa group "ad_admin" 
has setup to be able to log in anywhere, everyone else is denied.  With the 
default allow_all rule enabled, everything works as expected.  Any ideas on 
where I can look next?

Example grep from the client domain log (account had no changes to group 
membership):
(Fri Dec  4 00:46:35 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] 
(0x1000): [113] groups for [testu...@ad.domain.com]
(Fri Dec  4 00:47:31 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] 
(0x1000): [112] groups for [testu...@ad.domain.com]
(Fri Dec  4 01:00:20 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] 
(0x1000): [72] groups for [testu...@ad.domain.com]
(Fri Dec  4 01:10:24 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] 
(0x1000): [72] groups for [testu...@ad.domain.com]
(Fri Dec  4 01:14:20 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] 
(0x1000): [72] groups for [testu...@ad.domain.com]
(Fri Dec  4 01:24:21 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] 
(0x1000): [72] groups for [testu...@ad.domain.com]
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] 
(0x1000): [73] groups for [testu...@ad.domain.com]

Example of an HBAC rule passing:
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] 
(0x2000): Skipping non-group memberOf [CN=]
... repeated for however many groups happened to be examined
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] 
(0x1000): Added group [ad_admins] for user [testu...@ad.domain.com]
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added 
timed event "ltdb_callback": 0x2469f40
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added 
timed event "ltdb_timeout": 0x2460080
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running 
timer event 0x2469f40 "ltdb_callback"
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): 
Destroying timer event 0x2460080 "ltdb_timeout"
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending 
timer event 0x2469f40 "ltdb_callback"
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added 
timed event "ltdb_callback": 0x245aee0
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added 
timed event "ltdb_timeout": 0x2460080
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running 
timer event 0x245aee0 "ltdb_callback"
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): 
Destroying timer event 0x2460080 "ltdb_timeout"
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending 
timer event 0x245aee0 "ltdb_callback"
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added 
timed event "ltdb_callback": 0x2469f40
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added 
timed event "ltdb_timeout": 0x2460080
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running 
timer event 0x2469f40 "ltdb_callback"
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): 
Destroying timer event 0x2460080 "ltdb_timeout"
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending 
timer event 0x2469f40 "ltdb_callback"
(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ipa_hbac_evaluate_rules] 
(0x0080): Access granted by HBAC rule [admin-access]


Example of an HBAC rule failing:
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] 
(0x2000): Skipping non-group memberOf [CN=]
... repeated for however many groups happened to be examined
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] 
(0x2000): Skipping non-group memberOf [CN=]
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added 
timed event "ltdb_callback": 0x26f8d00
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added 
timed event "ltdb_timeout": 0x26e18d0
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running 
timer event 0x26f8d00 "ltdb_callback"
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): 
Destroying timer event 0x26e18d0 "ltdb_timeout"
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending 
timer event 0x26f8d00 "ltdb_callback"
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added 
timed event "ltdb_callback": 0x27e51f0
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added 
timed event "ltdb_timeout": 0x27f2230
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running 
timer event 0x27e51f0 "ltdb_callback"
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): 
Destroying timer event 0x27f2230 "ltdb_timeout"
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending 
timer event 0x27e51f0 "ltdb_callback"
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added 
timed event "ltdb_callback": 0x2634520
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added 
timed event "ltdb_timeout": 0x27f8a40
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running 
timer event 0x2634520 "ltdb_callback"
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): 
Destroying timer event 0x27f8a40 "ltdb_timeout"
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending 
timer event 0x2634520 "ltdb_callback"
(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ipa_hbac_evaluate_rules] 
(0x0080): Access denied by HBAC rules

Thanks,
   Jeff
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Reply via email to