My organization is trying to join our RHEL/CentOS 7 servers to our Microsoft AD domain. The domain controllers consist of 2x Windows 2008R2 servers and 1x Windows 2016 server.
On the Linux side, I'm using
realm to join to the domain, which I've managed to do successfully:
# realm list mydomain.net type: kerberos realm-name: MYDOMAIN.NET domain-name: mydomain.net configured: kerberos-member server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common-tools login-formats: %U@mydomain.net login-policy: allow-realm-logins
I would like to permit only members of a certain group access to SSH:
# realm permit -g firstname.lastname@example.org
That's when I encounter problems. When tested on two users, userA & userB, userA is allowed in, but userB is denied. The /var/log/sssd/sssd_mydomain.net.log file reveals that userB has no supplemental groups:
(Tue Sep 19 20:53:37 2017) [sssd[be[mydomain.net]]] [simple_access_check_send] (0x0200): Simple access check for userB@mydomain.net (Tue Sep 19 20:53:37 2017) [sssd[be[mydomain.net]]] [simple_check_get_groups_send] (0x0400): User userB@mydomain.net is a member of 0 supplemental groups (Tue Sep 19 20:53:37 2017) [sssd[be[mydomain.net]]] [simple_check_get_groups_send] (0x0400): All groups had name attribute
Or rather, it does, but none that SSSD can see. The following commands confirm that:
# id userA@mydomain.net uid=1918001261(userA@mydomain.net) gid=1918000513(domain email@example.com) groups=1918000513(domain firstname.lastname@example.org),1918001757(email@example.com),1918003900(sccm firstname.lastname@example.org),1918004006(ts remote desktop email@example.com),1918004329(firstname.lastname@example.org) # id userB@mydomain.net uid=1918003883(userB@mydomain.net) gid=1918000513(domain email@example.com) groups=1918000513(domain firstname.lastname@example.org)
Eventually, we found out that userA has the
adminCount attribute set to
1 in its AD/LDAP object. I'm not entirely sure what implications this attribute has, but it seems to be the reason why SSSD can find all of its supplemental groups and consequently it has found none for userB.
Any help would be greatly appreciated! I have been banging my head on this problem for a long, long time.
[sssd] domains = mydomain.net config_file_version = 2 services = nss, pam [domain/mydomain.net] ad_domain = mydomain.net krb5_realm = MYDOMAIN.NET realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%u@%d access_provider = simple simple_allow_groups = email@example.com debug = 6