0

I'm trying out sssd to use krb5 for authentication on a Ubuntu 18.04 host and can't figure out how to show the actual user groups (groups shows some sort of Windows SID instead of human readable names). The primary group looks ok (Domain Users...) but the rest (supplementary) are all S-x-x-x numbers. Is this an AD setting or something with my sssd config?

$ groups
Domain [email protected] [email protected] [email protected]...

sssd.conf

[nss]
   filter_groups        = root
   filter_users         = root
   reconnection_retries = 3

[pam]
   reconnection_retries = 3

[sssd]
   domains              = ad.mycorp.com
   config_file_version  = 2
   services             = nss, pam
   reconnection_retries = 3
   sbus_timeout         = 30

[domain/ad.mycorp.com]
   ad_domain            = ad.mycorp.com
   krb5_realm           = ad.mycorp.com
   realmd_tags          = manages-system joined-with-adcli
   cache_credentials    = True
   default_shell        = /bin/bash
   fallback_homedir     = /home/%d/%u

   krb5_store_password_if_offline   = True
   use_fully_qualified_names        = True

   ldap_sasl_authid     = UBU-TEST1$
   ldap_id_mapping      = True

   access_provider      = ldap
   id_provider          = ldap
   auth_provider        = krb5
   chpass_provider      = krb5

   ldap_uri             = ldaps://ad.mycorp.com
   ldap_search_base     = ou=mycorp,dc=mycorp,dc=com
   ldap_tls_cacert      = /etc/ssl/certs/ca-certificates.crt
   ldap_tls_reqcert     = allow
   dns_discovery_domain = ad.mycorp.com

   ldap_user_search_base   = ou=userid,ou=mycorp,dc=mycorp,dc=com
   ldap_group_search_base  = ou=mycorp,dc=mycorp,dc=com
   ldap_user_object_class  = user
   ldap_user_name          = sAMAccountName
   ldap_user_fullname      = displayName
   ldap_user_home_directory = unixHomeDirectory
   ldap_user_principal     = userPrincipalName
   ldap_group_object_class = group
   ldap_group_name         = sAMAccountName

   ldap_schema                = rfc2307bis
   ldap_access_order          = expire
   ldap_account_expire_policy = ad
   ldap_force_upper_case_realm = true
Improve this question
2
  • ldap_id_mapping = true Instructs sssd to generate group names based on the SID attribute so that seems expected behavior
    – Bob
    Aug 17, 2020 at 22:02
  • Ok so these aren't SIDs I'm seeing, but rather SSSD generated group names? How do I tell SSSD to just show the human readable group names from AD?
    – Server Fault
    Aug 18, 2020 at 17:01

3 Answers 3

Reset to default
1

This is a bit old but I thought that I would share the solution that worked for me.

I solved this by adding a line to the sssd.conf file, in the [domain/example.local] section :

ad_server = <domain controller name>.example.local

and keep

ldap_id_mapping = True
Improve this answer
0 
ldap_id_mapping = false

This will fetch POSIX attributes from your AD.

If you set this option to True then sssd will generate UID ,GID from SID.

Improve this answer
1
  • I've set ldap_id_mapping = false with no effect. Viewing the group attributes in the AD (ADUC) Attribute Editor tab, the sAMAccountName attribute correctly holds the name of the group. I'm pretty sure sssd is using the objectSid attribute instead and ignoring the ldap_group_name setting in the configuration.
    – Server Fault
    Aug 20, 2020 at 21:08
0

Did you clear the sssd cache ? #systemctl stop sssd; rm -r /var/lib/sss/db/* ; systemctl start sssd

Make sure you have POSIX attributes set in AD. Could be verified by ldapsearch also.

Improve this answer
1
  • Thanks. I did nuke /var/lib/sss/db/* last week and wasn't able to get things working again (eventually restored from a snapshot). Aha... ldapsearch doesn't show gidNumber or uidNumber attributes. I believe these may be sent over in the kerberos ticket somehow. I'm not terribly familiar with this system and still trying to find out who to talk to about it so still learning about it. ADUC shows the UNIX gid/uid numbers but they don't come through with ldapsearch which suggests I need to contact the AD admin.
    – Server Fault
    Sep 10, 2020 at 14:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .