Make sssd respect Acctive Directory nested groups
Solution 1
Take another look at the sssd.conf I gave you on your Wheezy SSSD-AD question over on StackExchange. You need the ldap_group_nesting_level = 5
entry to enable nested groups.
Solution 2
According to the logs SSSD was also complaining about a malformed filter:
(&(sAMAccountName=localUser)(objectclass=user)((null)=*))
Looks like you're using ID mapping along with the LDAP (not AD) provider in which case you need to configure the ldap_user_objectsid value:
ldap_user_objectsid = objectSid
Related videos on Youtube
Martin Nielsen
Updated on November 27, 2022Comments
-
Martin Nielsen over 1 year
I have managed to get sssd working and
getent passwd *username*
as well asgetent group
returns AD data. I am now facing a problem with nested groups in Active Directory.In the AD i have supergroup for the entire department. This group has the users as members.
Department group: CN=123 - DepartmentName,OU=departments,OU=SecurityGroups,DC=company,DC=country member CN=Benny Bob,OU=123 - DepartmentName,OU=other,OU=info,DC=company,DC=country member CN=Billy Bob,OU=123 - DepartmentName,OU=other,OU=info,DC=company,DC=country memberOf CN=RepositoryAuthorization,OU=Roles,OU=SecurityGroups,DC=company,DC=country
I also have a number of users, for example:
User : CN=Benny Bob,OU=xxx - DepartmentName,OU=other,OU=info,DC=company,DC=country memberOf CN=xxx - DepartmentName,OU=departments,OU=SecurityGroups,DC=company,DC=country (The department group) memberOf CN=ServerAuthorization,OU=Roles,OU=SecurityGroups,DC=company,DC=country
When i call
getent group | grep ServerAuthorization
the users (which are directly linked to the group) show up fine. However, when i callgetent group | grep RepositoryAuthorization
they are shown as having no members. RepositoryAuthorization is a member of the department group, that the users are members of. So its a nested group.I assume its a problem with my sssd setup. EDIT: This does not seem to be a problem of nesting directions. It seems that certain groups are simply not retrieved by SSSD.
All groups in
OU=Roles,OU=Security Groups....
are returned bygetent group
. However, groups inOU=Departments,OU=Security Groups....
are not.Settings are
ldap_group_search_base = OU=Security Groups...
and 'ldap_group_nesting_level = 100'This is the log for the
getent group
call (Loglevel 7) I am especially curious about this:(Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x0080): ldap_search_ext failed: Bad search filter (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [1432158235]: Malformed search filter (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [acctinfo_callback] (0x0100): Request processed. Returned 3,1432158235,Init group lookup failed
Full log:
(Tue Jan 27 15:58:15 2015) [sssd[be[Company.dk]]] [be_get_account_info] (0x0100): Got request for [4098][1][*] (Tue Jan 27 15:58:15 2015) [sssd[be[Company.dk]]] [be_req_set_domain] (0x0400): Changing request domain from [Company.dk] to [Company.dk] (Tue Jan 27 15:58:15 2015) [sssd[be[Company.dk]]] [sdap_handle_acct_req_send] (0x1000): Skipping group enumeration on demand (Tue Jan 27 15:58:15 2015) [sssd[be[Company.dk]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [be_get_account_info] (0x0100): Got request for [4099][1][name=localUser] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [be_req_set_domain] (0x0400): Changing request domain from [Company.dk] to [Company.dk] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [ou=Users,ou=Company,dc=Company,dc=dk] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=localUser)(objectclass=user)((null)=*))][ou=Users,ou=Company,dc=Company,dc=dk]. (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixHomeDirectory] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPrincipalName] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [displayName] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowLastChange] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMin] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMax] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowWarning] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowInactive] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowExpire] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowFlag] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbLastPwdChange] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPasswordExpiration] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [pwdAttribute] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [authorizedService] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nsAccountLock] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [host] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginDisabled] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginExpirationTime] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginAllowedTimeMap] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x0080): ldap_search_ext failed: Bad search filter (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [1432158235]: Malformed search filter (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [acctinfo_callback] (0x0100): Request processed. Returned 3,1432158235,Init group lookup failed (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [be_get_account_info] (0x0100): Got request for [4099][1][name=localUser] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [be_req_set_domain] (0x0400): Changing request domain from [Company.dk] to [Company.dk] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [ou=Users,ou=Company,dc=Company,dc=dk] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=localUser)(objectclass=user)((null)=*))][ou=Users,ou=Company,dc=Company,dc=dk]. (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixHomeDirectory] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPrincipalName] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [displayName] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowLastChange] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMin] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMax] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowWarning] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowInactive] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowExpire] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowFlag] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbLastPwdChange] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPasswordExpiration] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [pwdAttribute] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [authorizedService] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nsAccountLock] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [host] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginDisabled] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginExpirationTime] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginAllowedTimeMap] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x0080): ldap_search_ext failed: Bad search filter (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [1432158235]: Malformed search filter (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [acctinfo_callback] (0x0100): Request processed. Returned 3,1432158235,Init group lookup failed (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [be_get_account_info] (0x0100): Got request for [4099][1][name=localUser] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [be_req_set_domain] (0x0400): Changing request domain from [Company.dk] to [Company.dk] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [ou=Users,ou=Company,dc=Company,dc=dk] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=localUser)(objectclass=user)((null)=*))][ou=Users,ou=Company,dc=Company,dc=dk]. (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixHomeDirectory] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPrincipalName] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [displayName] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowLastChange] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMin] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMax] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowWarning] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowInactive] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowExpire] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowFlag] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbLastPwdChange] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPasswordExpiration] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [pwdAttribute] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [authorizedService] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nsAccountLock] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [host] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginDisabled] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginExpirationTime] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginAllowedTimeMap] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x0080): ldap_search_ext failed: Bad search filter (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [1432158235]: Malformed search filter (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [acctinfo_callback] (0x0100): Request processed. Returned 3,1432158235,Init group lookup failed (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [be_get_account_info] (0x0100): Got request for [4099][1][name=localUser] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [be_req_set_domain] (0x0400): Changing request domain from [Company.dk] to [Company.dk] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [ou=Users,ou=Company,dc=Company,dc=dk] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=localUser)(objectclass=user)((null)=*))][ou=Users,ou=Company,dc=Company,dc=dk]. (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixHomeDirectory] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPrincipalName] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [displayName] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowLastChange] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMin] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMax] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowWarning] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowInactive] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowExpire] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowFlag] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbLastPwdChange] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPasswordExpiration] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [pwdAttribute] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [authorizedService] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nsAccountLock] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [host] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginDisabled] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginExpirationTime] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginAllowedTimeMap] (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_ext_step] (0x0080): ldap_search_ext failed: Bad search filter (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [1432158235]: Malformed search filter (Tue Jan 27 15:58:25 2015) [sssd[be[Company.dk]]] [acctinfo_callback] (0x0100): Request processed. Returned 3,1432158235,Init group lookup failed
-
John over 9 yearsThat's not how nested groups work... Just because user 1 is a member of group A and group B is a member of group A doesn't mean user 1 is also a member of group B. Nesting means user 1 is in group A, group A is in group B, therefore user 1 is in group B.
-
Martin Nielsen over 9 yearsIsn't that what i have? User 1 (Benny) is in Department(Group A) Repo(Group B) is in Department(GroupA). I might be getting confused by member and memberOf, but in my case, GroupA(Dept) has 'member' on User1(Benny) and GroupB(Repo) has 'member" on GroupA(Dept). Shouldn't this work?
-
John over 9 yearsYou have: 1->A + B->A. You need: 1->A + A->B.
-
Martin Nielsen over 9 yearsI am very sorry for being confused, but it seems to be that's what i have. I have: u1 'memberof' gA | gA 'member' u1 gA 'memberOf' gB | gB 'member' gA... So 1 memberOf A + A memberOf B
-
John over 9 yearsYour initial description indicated case 1. If you do indeed have case 2, then you should be okay, and there is a problem with sssd somewhere.
-
Martin Nielsen over 9 yearsSorry for the confusion. I just realized that when i do a getent group | grep "theDepartmentName" it isn't returned. It seems that sssd does not retrieve the department group. All groups have the same object class.
-
-
Martin Nielsen over 9 yearsI did see it. I've tried 2, 10, 100 and now 5 :) What is odd, as i write in the question, is that the "department" groups are not even returned by getent, even though they have members in them directly.
-
Martin Nielsen over 9 yearsDamnit, i figured it out. The group search based missed a critical aggregation group that was between the users and the permission groups. Its working splendidly. Except for one group that is a member of domain users in OU=users,DC=cmp,DC=dk. This should add the group to all users, but it does not. But that is a minor annoyance i can work around:)