Hello, We are having a problem with HBAC that appears to be related to group membership lookup. I am testing with a new install on RHEL 7.2 with a cross-forest trust with AD. When an AD user attempts to log into a client (RH 6.7 or 7.2) the "hbac_eval_user_element" can report a different number of groups each time and never seems to contain the full list. For the testing account, running the 'id' command returns 153 groups. The ipa group "ad_admin" has setup to be able to log in anywhere, everyone else is denied. With the default allow_all rule enabled, everything works as expected. Any ideas on where I can look next?
Example grep from the client domain log (account had no changes to group membership): (Fri Dec 4 00:46:35 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): [113] groups for [[email protected]] (Fri Dec 4 00:47:31 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): [112] groups for [[email protected]] (Fri Dec 4 01:00:20 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): [72] groups for [[email protected]] (Fri Dec 4 01:10:24 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): [72] groups for [[email protected]] (Fri Dec 4 01:14:20 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): [72] groups for [[email protected]] (Fri Dec 4 01:24:21 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): [72] groups for [[email protected]] (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): [73] groups for [[email protected]] Example of an HBAC rule passing: (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x2000): Skipping non-group memberOf [CN=] ... repeated for however many groups happened to be examined (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): Added group [ad_admins] for user [[email protected]] (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x2469f40 (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x2460080 (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running timer event 0x2469f40 "ltdb_callback" (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Destroying timer event 0x2460080 "ltdb_timeout" (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending timer event 0x2469f40 "ltdb_callback" (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x245aee0 (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x2460080 (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running timer event 0x245aee0 "ltdb_callback" (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Destroying timer event 0x2460080 "ltdb_timeout" (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending timer event 0x245aee0 "ltdb_callback" (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x2469f40 (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x2460080 (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running timer event 0x2469f40 "ltdb_callback" (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Destroying timer event 0x2460080 "ltdb_timeout" (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending timer event 0x2469f40 "ltdb_callback" (Fri Dec 4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule [admin-access] Example of an HBAC rule failing: (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x2000): Skipping non-group memberOf [CN=] ... repeated for however many groups happened to be examined (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x2000): Skipping non-group memberOf [CN=] (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x26f8d00 (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x26e18d0 (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running timer event 0x26f8d00 "ltdb_callback" (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Destroying timer event 0x26e18d0 "ltdb_timeout" (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending timer event 0x26f8d00 "ltdb_callback" (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x27e51f0 (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x27f2230 (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running timer event 0x27e51f0 "ltdb_callback" (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Destroying timer event 0x27f2230 "ltdb_timeout" (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending timer event 0x27e51f0 "ltdb_callback" (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x2634520 (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x27f8a40 (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running timer event 0x2634520 "ltdb_callback" (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Destroying timer event 0x27f8a40 "ltdb_timeout" (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending timer event 0x2634520 "ltdb_callback" (Thu Dec 3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ipa_hbac_evaluate_rules] (0x0080): Access denied by HBAC rules Thanks, Jeff
-- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
