<div class="gmail_quote">On Fri, Jul 23, 2010 at 6:16 AM, Sumit Bose <<a href="mailto:sbose@redhat.com">sbose@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> <div><div></div><div class="h5">On Thu, Jul 22, 2010 at 04:49:50PM -0400, Simo Sorce wrote: > On Thu, 22 Jul 2010 16:22:45 -0400 > Scott Duckworth <<a href="mailto:sduckwo@clemson.edu">sduckwo@clemson.edu</a>> wrote: > > > On Thu, Jul 22, 2010 at 3:39 PM, Simo Sorce <<a href="mailto:ssorce@redhat.com">ssorce@redhat.com</a>> wrote: > > > > > On Thu, 22 Jul 2010 15:30:23 -0400 > > > Scott Duckworth <<a href="mailto:sduckwo@clemson.edu">sduckwo@clemson.edu</a>> wrote: > > > > > > > On Thu, Jul 22, 2010 at 11:59 AM, Simo Sorce <<a href="mailto:ssorce@redhat.com">ssorce@redhat.com</a>> > > > > wrote: > > > > > > > > > On Thu, 22 Jul 2010 11:10:25 -0400 > > > > > Scott Duckworth <<a href="mailto:sduckwo@clemson.edu">sduckwo@clemson.edu</a>> wrote: > > > > > > > > > > > I removed all files from /var/lib/sss/db/ and restarted sssd. > > > > > > Same behavior. nscd is disabled, so I don't think it's > > > > > > caching at any level. > > > > > > > > > > > > Here is what I ran: > > > > > > > > > > > > [root@duck2 ~]# getent passwd sduckwo > > > > > > sduckwo:*:45265:10000:Scott Duckworth:/home/sduckwo:/bin/bash > > > > > > [root@duck2 ~]# groups sduckwo > > > > > > sduckwo : cuuser > > > > > > [root@duck2 ~]# getent group coes_socunix > > > > > > coes_socunix:*:120105:sduckwo > > > > > > > > > > > > > > I should add to this, that what I expected to see is this (from > > > > one of the RHEL boxes using nss_ldap): > > > > > > > > [root@potter commands]# groups sduckwo > > > > sduckwo : cuuser coes_dpa coes_socunix coes_web_cs coes_web_fx > > > > > > If you log in as sduckwo you should just see that. > > > The same if you do "id sduckwo" > > > > > > > No go... > > > > [root@duck2 ~]# service sssd stop > > [root@duck2 ~]# rm -f /var/lib/sss/db/* > > [root@duck2 ~]# service nscd stop > > [root@duck2 ~]# service sssd start > > Starting sssd: [ OK ] > > [root@duck2 ~]# id sduckwo > > uid=45265(sduckwo) gid=10000(cuuser) groups=10000(cuuser) > > [root@duck2 ~]# su - sduckwo > > [16:05:24] sduckwo@duck2:~ [1] id > > uid=45265(sduckwo) gid=10000(cuuser) groups=10000(cuuser) > > [16:05:26] sduckwo@duck2:~ [2] groups > > cuuser > > Uhmmm this may be a side effect of your directory not having memberof > I think we need to add special code to handle servers that use > rfc2307bis schema but that do not use memberof. </div></div>In my test setup eDirectory uses an attribute named groupMembership in the user object to store the DN of the groups the user belongs to. Can you check if adding the option ldap_user_member_of = groupMembership does help here? </blockquote><div> I've learned that this attribute does exist in our tree, but it's not being populated when we add users to groups since our proxy user does not have rights to write groupMembership to users. I'm trying to find out if we can get our hands on native eDirectory tools that keep groupMembership of posixAccount and member of posixGroup in sync. Still, if groupOf/groupMembership is not required by rfc2307bis, it would be nice if SSSD did not require it. If a user has a groupOf/groupMembership attribute pointing to a group outside of ldap_group_search_base, will this be handled gracefully? </div></div>