On Thu, Mar 05, 2015 at 08:32:32AM +0100, Łukasz Jaworski wrote:
Hello,
I have group issue on sssd 1.8.6 and 1.11.5 (on ubuntu 12.04 and 14.04) and
freeipa4 (freeipa-server-4.1.2-1 on fedora 21, 389-ds-base-1.3.3.8-1).
If user has assigned Role I couldn't get all groups with id command.
All works for users without role/special permissions.
Information about test users from ipa server:
User with role helpdesk:
# ipa user-show test1
User login: test1
Member of groups: testgroup2, testgroup3, ipausers, testgroup4, testgroup1
Roles: helpdesk
User without role:
# ipa user-show test2
User login: test2
Member of groups: testgroup2, ipausers, testgroup4, testgroup1, testgroup3
Information about user on client (ubuntu 12.04):
# id test1
uid=1016(test1) gid=1016(test1) groups=1016(test1)
# id test2
uid=1022(test2) gid=1022(test2)
groups=1022(test2),1014(testgroup4),1012(testgroup3),1011(testgroup2),1004(testgroup1)
(Thu Mar 5 08:23:54 2015) [sssd[nss]] [sss_parse_name_for_domains] (0x0200):
name 'test1' matched without domain, user is test1
(Thu Mar 5 08:23:54 2015) [sssd[nss]] [sss_parse_name_for_domains] (0x0200):
using default domain [(null)]
(Thu Mar 5 08:23:54 2015) [sssd[nss]] [nss_cmd_getbynam] (0x0100):
Requesting info for [test1] from [ALL]
(Thu Mar 5 08:23:54 2015) [sssd[nss]] [nss_cmd_initgroups_search] (0x0100):
Requesting info for [te...@example.com]
(Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]] [be_get_account_info]
(0x0100): Got request for [4099][1][name=test1]
(Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]]
[sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain
SID from [(null)]
(Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]]
[sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain
SID from [(null)]
(Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]] [sdap_attrs_get_sid_str]
(0x0080): No [objectSIDString] attribute while id-mapping. [0][Success]
(Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]]
[sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain
SID from [(null)]
(Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]] [sdap_parse_deref]
(0x0080): Dereferenced entry [cn=helpdesk,cn=roles,cn=accounts,dc=example]
has no attributes
This ^^ line tells me it's a known SSSD bug:
https://fedorahosted.org/sssd/ticket/2421
This bug only happens in a combination of old client and a particular
server version.
IIRC a subsequent server update fixed the ACIs on the server so that at
least objectClass was readable. You can also work around the bug on the
client by disabling dereference:
ldap_deref_threshold = 0
btw sssd version 1.8 is quite old and not supported upstream anymore..
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project
