Hello, I have group issue on sssd 1.8.6 and 1.11.5 (on ubuntu 12.04 and 14.04) and freeipa4 (freeipa-server-4.1.2-1 on fedora 21, 389-ds-base-1.3.3.8-1).
If user has assigned Role I couldn't get all groups with "id" command. All works for users without role/special permissions. Information about test users from ipa server: User with role helpdesk: # ipa user-show test1 User login: test1 Member of groups: testgroup2, testgroup3, ipausers, testgroup4, testgroup1 Roles: helpdesk User without role: # ipa user-show test2 User login: test2 Member of groups: testgroup2, ipausers, testgroup4, testgroup1, testgroup3 Information about user on client (ubuntu 12.04): # id test1 uid=1016(test1) gid=1016(test1) groups=1016(test1) # id test2 uid=1022(test2) gid=1022(test2) groups=1022(test2),1014(testgroup4),1012(testgroup3),1011(testgroup2),1004(testgroup1) (Thu Mar 5 08:23:54 2015) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'test1' matched without domain, user is test1 (Thu Mar 5 08:23:54 2015) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)] (Thu Mar 5 08:23:54 2015) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [test1] from [<ALL>] (Thu Mar 5 08:23:54 2015) [sssd[nss]] [nss_cmd_initgroups_search] (0x0100): Requesting info for [[email protected]] (Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]] [be_get_account_info] (0x0100): Got request for [4099][1][name=test1] (Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)] (Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)] (Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]] [sdap_attrs_get_sid_str] (0x0080): No [objectSIDString] attribute while id-mapping. [0][Success] (Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)] (Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]] [sdap_parse_deref] (0x0080): Dereferenced entry [cn=helpdesk,cn=roles,cn=accounts,dc=example] has no attributes (Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]] [sdap_x_deref_parse_entry] (0x0040): sdap_parse_deref failed [22]: Invalid argument (Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]] [sdap_get_generic_ext_done] (0x0020): reply parsing callback failed. (Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]] [sdap_x_deref_search_done] (0x0100): sdap_get_generic_ext_recv failed [22]: Invalid argument (Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]] [sdap_deref_search_done] (0x0040): dereference processing failed [22]: Invalid argument (Thu Mar 5 08:23:54 2015) [sssd[be[example.com]]] [acctinfo_callback] (0x0100): Request processed. Returned 3,22,Init group lookup failed (Thu Mar 5 08:23:54 2015) [sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data Provider Error: 3, 22, Init group lookup failed Will try to return what we have in cache sssd.conf: [domain/example.com] cache_credentials = True krb5_store_password_if_offline = True krb5_realm = example ipa_domain = example.com id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = test.example.com chpass_provider = ipa ipa_server =ipaserver.example.com ldap_tls_cacert = /etc/ipa/ca.crt enumerate = False min_id = 1000 lookup_family_order = ipv4_only [sssd] services = nss, pam, sudo, ssh config_file_version = 2 domains = example.com [nss] [pam] [sudo] [autofs] [ssh] Best regards Łukasz Jaworski "Ender" -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go To http://freeipa.org for more info on the project
