3

I am having an issue that might be mostly cosmetic but I've gotta keep the user complaints down. :)

I have a set of servers running CentOS 7.4 and have the requirement to join the servers to an Active Directory domain. The users are defined in the domain with POSIX attributes but there are not groups defined for each user. I joined the domain with

realm join --user=me --membership-software=adcli --computer-name=myhostname EXAMPLE.GOV

My /etc/sssd/sssd.conf contains this

[sssd]
domains = example.gov
config_file_version = 2
services = nss, pam
default_domain_suffix = EXAMPLE.GOV

[domain/example.gov]
ad_domain = example.gov
krb5_realm = EXAMPLE.GOV
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_sasl_authid = myhostname$
ldap_id_mapping = False
use_fully_qualified_names = True
fallback_homedir = /home/%u
ldap_user_home_directory = unixHomeDirectory
access_provider = ad
full_name_format = %1$s
override_shell = /bin/bash

So far so good but I do have a problem with getting a group name for myself.

$ id me
uid=123456(me) gid=123456 groups=123456
$ getent passwd me
me:*:123456:123456:Doug:/home/me:/bin/bash
$ getent group me
$

What I want is for getent group me to return 123456. It looks like the sssd configuration options auto_private_groups or magicPrivateGroups (magic_private_groups?) is what I'm looking for but neither option is supported under CentOS 7.

Turning on ldap_id_mapping is not a option as these ids are not consistent across all of our platforms. Any suggestions?

  • Have you got an entry in /etc/nsswitch.conf for groups pointing to the AD? – Raman Sailopal Feb 23 '18 at 16:23
  • @RamanSailopal Yes. /etc/nsswitch is set to 'files sss' for passwd, shadow, and group. – doneal24 Feb 23 '18 at 16:29
  • 1
    Since you've got ldap_id_mapping = false and presumably no POSIX gidNumber identifiers in AD, what is to determine that your GID should be 123456? – roaima Feb 28 '18 at 14:29
  • @roaima We do have POSIX identifiers in AD for the user OU which does have gidNumber=123456, otherwise the passwd entry would not come up correctly. The problem is that there is no entry for me in the group OU. – doneal24 Feb 28 '18 at 15:05
  • 1
    Oh I see. I wasn't familiar with that new feature. How many users does this affect on any one machine? Perhaps you could use pam_exec to add an entry in the local /etc/groups as a user logs in? (If this is viable I can give you a fuller answer.) – roaima Feb 28 '18 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.