3

I've got a host of servers running various flavors of Linux all setup as OpenLDAP clients via SSSD. I added an LDAP group (sysadmins). I also added a sysadmins group on all of my servers. The members of the sysadmins group will change over time.

How can I get all users in the LDAP group to be added to the local group on login?

  • 1
    Why do you want to do this? Having these group members in a central location is one of the most important features of an LDAP user database. – Sven Jan 25 '16 at 21:49
  • Also see my answer at serverfault.com/a/908097/267016 for a method to add all users to a local group at login time. – roaima Apr 17 '18 at 22:21
2

There's one way of accomplishing this at the moment -- you can either add the user on each host locally and then add the member from LDAP into /etc/groups.

The second way is currently under development for glibc and wouldn't make it to RHEL sooner than 7.3 but you can read about it here: https://sourceware.org/glibc/wiki/Proposals/GroupMerging

That would basically allow you to define the group both locally and in LDAP and have libc merge the group contents.

| improve this answer | |
2

According to the ubuntu documentation you can do a mapping of domain users to local groups, I'm not sure if it is applicable to any OS, but it seems to use standard modules that should be on any *nix system.

From Ubuntu docs

Assign local groups to users

To assign local groups to a domain (ldap) user do the following edit /etc/security/group.conf and add something like the following to it (log in as a local user and run the groups command to verify what to add):

*;*;*;Al0000-2400;audio,cdrom,dialout,floppy

In order to get the pam_group module working you could create a file like /usr/share/pam-configs/my_groups:

Name: activate /etc/security/group.conf
Default: yes

Priority: 900
Auth-Type: Primary Auth:
        required                        pam_group.so

and activate it by running pam-auth-update.

This roughly equals editing /etc/pam.d/common-auth by hand and adding the following line before any pam_ldap and pam_krb5 settings:

auth required pam_group.so

You should now have local groups showing up for users logging in via gdm and ssh and can verify this by executing id or groups.

Finalize

Just to make sure everything works, run the following:

pam-auth-update
/etc/init.d/nscd restart
| improve this answer | |
  • Note that due to a bug in GDM/Gnome (and other display managers have had this too) even if you have a correct pam_group setup, it may only work when you log in via SSH or a terminal from Ctrl+Alt+F1-F5 and not inside your GUI session. This is possibly due to adoption of systemd and the --user sessions it can trigger for things like Gnome-terminal that don't automatically inherit groups because it doesn't do a PAM check apparently. – dragon788 Aug 22 '18 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.