<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 04/17/2015 09:12 PM, Benjamen
Keroack wrote:<br>
</div>
<blockquote
cite="mid:CAHz7M2o-WeC0-BaoM2YpCGm91M+fNvOeMR7zRXGMXKfrB1ggAQ@mail.gmail.com"
type="cite">
<div dir="ltr">Hi,
<div><br>
</div>
<div>We have a number of local groups on our IPA-managed servers
that we add LDAP/IPA users to. This works fine locally on the
server on an ad hoc basis:</div>
<div><br>
</div>
<div>$ usermod -a -G local-group test.user</div>
<div><br>
</div>
<div>However I'm trying to do this as part of user provisioning
in IPA via user groups. I've created external user groups in
IPA, then added those external groups to the user groups that
new users are added to via automember rules. For example:</div>
<div><br>
</div>
<div>local-group [external] -> [is a member of] ->
developers [IPA group]</div>
<div><br>
</div>
<div>Then I SSH into one of the servers as a user who is a
member of developers:</div>
<div><br>
</div>
<div>test.user@qa$ groups</div>
<div>test.user developers qa_users</div>
<div><br>
</div>
<div>I do not see 'local-group' membership, even after
restarting sssd/rebooting. Is it possible to achieve this kind
of automatic local group membership? The only alternative I
can see would be to write a SUID binary that .bash_profile
runs on login to add them to the applicable groups, which
seems like a bad hack.</div>
<div><br>
</div>
<div>This is IPA 4.1.0 running on RHEL 7.1. Client servers are
Ubuntu Trusty.</div>
<div>
<div><br>
</div>
<div>Thanks for any help,</div>
<div><br>
</div>
-- <br>
<div class="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>Benjamen Keroack</div>
<div><i>Infrastructure/DevOps Engineer</i></div>
<div><a moz-do-not-send="true"
href="mailto:benjamen@dollarshaveclub.com"
target="_blank">benjamen@dollarshaveclub.com</a></div>
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
It looks like you are looking for this:
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/sssd/ticket/1591">https://fedorahosted.org/sssd/ticket/1591</a><br>
It is on the roadmap for 1.13 alpha which should be out in couple
months.<br>
Would you be interested to test?<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>