[Freeipa-users] group issue (freeipa4)

[Łukasz Jaworski]

Hello,

I have group issue on sssd 1.8.6 and 1.11.5 (on ubuntu 12.04 and 14.04) and freeipa4 (freeipa-server-4.1.2-1 on fedora 21, 389-ds-base-1.3.3.8-1).

If user has assigned Role I couldn't get all groups with "id" command.
All works for users without role/special permissions.

Information about test users from ipa server:

User with role helpdesk:
# ipa user-show test1
  User login: test1
  Member of groups: testgroup2, testgroup3, ipausers, testgroup4, testgroup1
  Roles: helpdesk

User without role:
# ipa user-show test2
  User login: test2
  Member of groups: testgroup2, ipausers, testgroup4, testgroup1, testgroup3

Information about user on client (ubuntu 12.04):

# id test1
uid=1016(test1) gid=1016(test1) groups=1016(test1)

# id test2
uid=1022(test2) gid=1022(test2) groups=1022(test2),1014(testgroup4),1012(testgroup3),1011(testgroup2),1004(testgroup1)


(Thu Mar  5 08:23:54 2015) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'test1' matched without domain, user is test1
(Thu Mar  5 08:23:54 2015) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)]
(Thu Mar  5 08:23:54 2015) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [test1] from [<ALL>]
(Thu Mar  5 08:23:54 2015) [sssd[nss]] [nss_cmd_initgroups_search] (0x0100): Requesting info for [test1 at example.com]
(Thu Mar  5 08:23:54 2015) [sssd[be[example.com]]] [be_get_account_info] (0x0100): Got request for [4099][1][name=test1]
(Thu Mar  5 08:23:54 2015) [sssd[be[example.com]]] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)]
(Thu Mar  5 08:23:54 2015) [sssd[be[example.com]]] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)]
(Thu Mar  5 08:23:54 2015) [sssd[be[example.com]]] [sdap_attrs_get_sid_str] (0x0080): No [objectSIDString] attribute while id-mapping. [0][Success]
(Thu Mar  5 08:23:54 2015) [sssd[be[example.com]]] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)]
(Thu Mar  5 08:23:54 2015) [sssd[be[example.com]]] [sdap_parse_deref] (0x0080): Dereferenced entry [cn=helpdesk,cn=roles,cn=accounts,dc=example] has no attributes
(Thu Mar  5 08:23:54 2015) [sssd[be[example.com]]] [sdap_x_deref_parse_entry] (0x0040): sdap_parse_deref failed [22]: Invalid argument
(Thu Mar  5 08:23:54 2015) [sssd[be[example.com]]] [sdap_get_generic_ext_done] (0x0020): reply parsing callback failed.
(Thu Mar  5 08:23:54 2015) [sssd[be[example.com]]] [sdap_x_deref_search_done] (0x0100): sdap_get_generic_ext_recv failed [22]: Invalid argument
(Thu Mar  5 08:23:54 2015) [sssd[be[example.com]]] [sdap_deref_search_done] (0x0040): dereference processing failed [22]: Invalid argument
(Thu Mar  5 08:23:54 2015) [sssd[be[example.com]]] [acctinfo_callback] (0x0100): Request processed. Returned 3,22,Init group lookup failed
(Thu Mar  5 08:23:54 2015) [sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data Provider
Error: 3, 22, Init group lookup failed
Will try to return what we have in cache


sssd.conf:

[domain/example.com]
cache_credentials = True
krb5_store_password_if_offline = True
krb5_realm = example
ipa_domain = example.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = test.example.com
chpass_provider = ipa
ipa_server =ipaserver.example.com
ldap_tls_cacert = /etc/ipa/ca.crt
enumerate = False
min_id = 1000
lookup_family_order = ipv4_only


[sssd]
services = nss, pam, sudo, ssh
config_file_version = 2
domains = example.com

[nss]

[pam]

[sudo]

[autofs]

[ssh]



Best regards
Łukasz Jaworski "Ender"