Domain groups not accepted as 'AdminIdentities'

[James Paton-Smith]

Domain groups cannot be configured as 'AdminIdentities' under /etc/polkit-1/localauthority.conf.d

EXAMPLE CONFIG

# /etc/polkit-1/localauthority.conf.d/90-test.conf
[Configuration]
AdminIdentities=unix-group:sysapp

With the above config, 'sysapp' is a group in LDAP. SSSD is configured on the machine to allow domain users to log in.
Sudo rules have been configured for the 'sysapp' group and work correctly.

However, any action that creates a polkit/GUI prompt for authentication does not allow users in the 'sysapp' group to authenticate. Instead, it only accepts auth from the root user.

If I change the config to use a local group, instead of a domain group, everything works as expected.
Similarly if I specify a domain USER instead of a domain group, everything works as expected.

The problem seems to only be with domain/LDAP groups.

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: policykit-1 0.105-33
ProcVersionSignature: Ubuntu 5.15.0-48.54-generic 5.15.53
Uname: Linux 5.15.0-48-generic x86_64
ApportVersion: 2.20.11-0ubuntu82.1
Architecture: amd64
CasperMD5CheckResult: unknown
Date: Mon Oct 3 15:20:36 2022
InstallationDate: Installed on 2022-07-15 (80 days ago)
InstallationMedia: Ubuntu 20.04.1 LTS "Focal Fossa" - Release amd64 (20200731)
SourcePackage: policykit-1
UpgradeStatus: Upgraded to jammy on 2022-08-02 (61 days ago)

[Vegard Søbstad Alsli (alslinet)]

This affects 20.04 as well. Can confirm groups do not work and the workarounds for the problems are creative to say the least.

[James Paton-Smith (jamesps)]

After revisiting this, I found the issue was on my side.

Our LDAP wasn't returning the members list for groups when queried so polkit wasn't able to authorise those users.
I fixed this in our sssd.conf using the 'ignore_group_members = false' option.