We have sssd configuration as follows:
id_provider = ad auth_provider = krb5 access_provider = ldap enumerate = false ignore_group_members = true;
As you can see, we are not enumerating users and groups and hence,
getent passwd and
getent group doesn't show the users and groups from ad.
Now, I want to understand how
id -a <aduser> command shows the user and it's groups. I understand that it does realtime fetch for the given username or retrieve from sssd cache. But I want to know exactly what tells id command to fetch this info from sssd.
Some background info for my question:
I am trying to setup ldap authentication in our mysql 5.6 community server and for that I am using auth_pam.so which I copied from percona server of my local VM.
I have created a proxy user:
ad_dba and mapped with ldap group:
And I created the following pam service:
# cat /etc/pamd./mysqld #%PAM-1.0 auth include password-auth audit account include password-auth audit
So, my auth_string is as follows:
Now, I gave complete privileges to the proxy user:
However, I can only authenticate with my ad usera but doesn't have any privileges. My understanding is that the group mapping doesn't work.
I am not sure how mysql checks user group members. I am trying to see if I can add a specific module in PAM just to retrive this group info.
I see from source code, that the mysql plugin is using built-in linux functions
So, I must find a way to list my required groups and users in groups database or change the code and recompile. My question has become irrevalent now to this issue. But I am still eager to find out how id gets this info.