On Mon, Nov 10, 2014 at 05:18:16PM +0300, Sergey Urushkin wrote: > I have sssd (1.12.2 on archlinux, 1.11.5 on ubuntu 14.04, 1.11.7 on ubuntu > 14.10, i386) configured against samba4 (4.1.11, ubuntu 14.04, amd64) using > AD provider: > [sssd] > config_file_version = 2 > reconnection_retries = 2 > services = nss, pam > domains = DOMAIN.COM > [nss] > filter_groups = root > filter_users = root > reconnection_retries = 2 > [pam] > reconnection_retries = 2 > [domain/DOMAIN.COM] > id_provider = ad > auth_provider = ad > chpass_provider = ad > access_provider = ad > ldap_schema = ad > ldap_user_gecos = displayName > ldap_tls_reqcert = allow > ldap_sasl_mech = gssapi > ldap_sasl_authid = [email protected] > krb5_use_enterprise_principal = false > krb5_keytab = /etc/sssd/sssd.keytab > ldap_id_mapping = false > dyndns_update = false > cache_credentials = true > enumerate = false > min_id = 1 > > I have sudo and sshd configured to use groups: > # grep group1 /etc/ssh/sshd_config > AllowGroups root group1 > # grep group1 /etc/sudoers > %group1 ALL=(ALL) ALL > > User 'user4' is a member of several domain posix not nested groups, > including 'group1'. No local group membership. > After starting sssd (with empty /var/lib/sss). Authentication and local > logon works fine. 'getent group' shows correct group members: > # getent group group1 > group1:*:1013:user1,user2,user3,user4,user5 > ... but 'id' shows primary group only: > # id user4 > uid=1104(user4) gid=513(domain users) groups=513(domain users) > > Now, trying to use sudo (local): > $ sudo -s > [sudo] password for user4: > user4 is not in the sudoers file. This incident will be reported. > > ... or login remotely via ssh (sshd log message): > User user4 from host.domain.com not allowed because none of user's groups > are listed in AllowGroups > > After this, 'id' output stays the same: > # id user4 > uid=1104(user4) gid=513(domain users) groups=513(domain users) > > But 'user4' dissapears from 'getent group' output: > # getent group group1 > group1:*:1013:user1,user2,user3,user5 > > Restarting sssd doesn't fix the issue. User appears in group list again only > after removing 'db/cache_DOMAIN.COM.ldb' file and restarting sssd. But > disappears again after the same actions (ssh/sudo). Next options doesn't > help too: > ldap_id_mapping = true > enumerate = true > > winbind 4.1 works absolutely fine against the same AD server. So, I think > the problem is about sssd... > > Summary: > * sssd group membership ACL checks don't work. User disappears from 'getent > group' output after such check. > * 'id' shows primary group only > > Should I file a bug report? > Thanks!
I think yes, also include sssd debug logs that capture the 'removal' of the group memberships from the database. Thanks! _______________________________________________ sssd-users mailing list [email protected] https://lists.fedorahosted.org/mailman/listinfo/sssd-users
