Re: [Freeipa-users] SSSD bug found? FreeIPA vs SSSD

2017-03-13 Thread Lachlan Musicman
I am still having problems with FreeIPA/HBAC, SSSD and logging into hosts. Could this be the reason that SSSD isn't picking up the full list of groups a user belongs to? In particular, ipa hbac test says true. "id domain\\username" or "id username@domain" returns the correct groups. But the

Re: [Freeipa-users] SSSD bug found? FreeIPA vs SSSD

2017-03-09 Thread Jakub Hrozek
On Thu, Mar 09, 2017 at 11:32:35AM +0200, Alexander Bokovoy wrote: > On to, 09 maalis 2017, Jakub Hrozek wrote: > > On Thu, Mar 09, 2017 at 01:37:46PM +1100, Lachlan Musicman wrote: > > > Hola, > > > > > > On CentOS 7.3, using FreeIPA VERSION: 4.4.0, API_VERSION: 2.213 and sssd > > > (via COPR)

Re: [Freeipa-users] SSSD bug found? FreeIPA vs SSSD

2017-03-09 Thread Alexander Bokovoy
On to, 09 maalis 2017, Jakub Hrozek wrote: On Thu, Mar 09, 2017 at 01:37:46PM +1100, Lachlan Musicman wrote: Hola, On CentOS 7.3, using FreeIPA VERSION: 4.4.0, API_VERSION: 2.213 and sssd (via COPR) 1.15.1, which has a one way trust to an AD domain. unix.name.org -> name.org I've seen some

Re: [Freeipa-users] SSSD bug found? FreeIPA vs SSSD

2017-03-09 Thread Jakub Hrozek
On Thu, Mar 09, 2017 at 01:37:46PM +1100, Lachlan Musicman wrote: > Hola, > > On CentOS 7.3, using FreeIPA VERSION: 4.4.0, API_VERSION: 2.213 and sssd > (via COPR) 1.15.1, which has a one way trust to an AD domain. unix.name.org > -> name.org > > I've seen some interesting behaviour. > > Being

[Freeipa-users] SSSD bug found? FreeIPA vs SSSD

2017-03-08 Thread Lachlan Musicman
Hola, On CentOS 7.3, using FreeIPA VERSION: 4.4.0, API_VERSION: 2.213 and sssd (via COPR) 1.15.1, which has a one way trust to an AD domain. unix.name.org -> name.org I've seen some interesting behaviour. Being part of a large organisation with a smaller nix environment and a larger Windows