<html><body><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000"><div>Hi, we are curretly workig on a larger IPA test project and I have a problems which have been buggin me for some time now:</div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>On the client we are have set "full_name_format = %1$s" to have users presented without the AD domain part.</div><div>However, this seems to make SSSD not lookup a users group membership?</div><div><br data-mce-bogus="1"></div><div>sssd.conf from server:</div><div><br data-mce-bogus="1"></div><div>[domain/linux.dr.dk]<br><br>cache_credentials = True<br># krb5_store_password_if_offline = True<br>ipa_domain = linux.dr.dk<br>id_provider = ipa<br>auth_provider = ipa<br>access_provider = ipa<br>ipa_hostname = ipa01tst.linux.dr.dk<br>chpass_provider = ipa<br>ipa_server = ipa01tst.linux.dr.dk<br>ipa_server_mode = True<br>ldap_tls_cacert = /etc/ipa/ca.crt<br><br># Bugfix untill RHEL 7.3 arrives<br># http://www.redhat.com/archives/freeipa-users/2016-May/msg00209.html<br>ldap_user_principal = nosuchattr<br><br>ignore_group_members = True<br>ldap_purge_cache_timeout = 0<br>subdomain_inherit = ldap_user_principal, ignore_group_members, ldap_purge_cache_timeout<br><br>debug_level=3<br><br># Added to list users faster eg id jly@net.dr.dk<br>ldap_use_tokengroups = True<br>ldap_id_mapping = True<br><br>[sssd]<br>services = nss, sudo, pam, ssh<br>config_file_version = 2<br>domains = linux.dr.dk<br>default_domain_suffix = NET.DR.DK</div><div><br data-mce-bogus="1"></div><div>[nss]<br>memcache_timeout = 600<br>homedir_substring = /home<br><br>[pam]<br>[sudo]<br>[autofs]<br>[ssh]<br>[pac]<br>[ifp]</div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>sssd.conf from client:</div><div><br data-mce-bogus="1"></div><div>[domain/linux.dr.dk]<br><br>cache_credentials = True<br>krb5_store_password_if_offline = True<br>ipa_domain = linux.dr.dk<br>id_provider = ipa<br>auth_provider = ipa<br>access_provider = ipa<br>ipa_hostname = rhel01udv.linux.dr.dk<br>chpass_provider = ipa<br>ipa_server = ipa01tst.linux.dr.dk<br>ldap_tls_cacert = /etc/ipa/ca.crt<br><br>debug_level=5<br><br>[sssd]<br>services = nss, sudo, pam, ssh<br>config_file_version = 2<br>domains = linux.dr.dk<br>default_domain_suffix = NET.DR.DK<br># full_name_format = %1$s<br><br>[nss]<br>homedir_substring = /home<br><br>[pam]<br>[sudo]<br>[autofs]<br>[ssh]<br>[pac]<br>[ifp]</div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>With "<span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">full_name_format</span>" commented out on client I get the full list of groups for a user:</div><div><br data-mce-bogus="1"></div><div># sss_cache -E && rm -f /var/lib/sss/db/* && systemctl restart sssd</div><div># getent passwd drextrha@net.dr.dk<br>drextrha@net.dr.dk:*:1349938498:1349938498:DREXTRHA:/home/net.dr.dk/drextrha:</div><div><br></div><div># id drextrha@net.dr.dk</div><div>gives full groups list</div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>If I enable the "<span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">full_name_format</span>" parameter I get:</div><div><br data-mce-bogus="1"></div><div>Clear cache.</div><div># sss_cache -E && rm -f /var/lib/sss/db/* && systemctl restart sssd</div><div><br data-mce-bogus="1"></div><div>#getent passwd drextrha@net.dr.dk<br>drextrha:*:1349938498:1349938498:DREXTRHA:/home/net.dr.dk/drextrha:</div><div><br data-mce-bogus="1"></div><div>but:</div><div>id drextrha@net.dr.dk<br>uid=1349938498(drextrha) gid=1349938498(drextrha) groups=1349938498(drextrha),10012(ad_admins)</div><div><br data-mce-bogus="1"></div><div>only gives my primary group and a single IPA group</div><div><br data-mce-bogus="1"></div><div>Everything runnig RHEL 7.2, sssd 1.13.0-40.el7_2.12</div><div><br data-mce-bogus="1"></div><div>Am I doing something wrong?</div><div><br data-mce-bogus="1"></div></div></body></html>