sssd sometimes forgets all but one group memberships of a user
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
sssd (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
I have sssd configured to look up names in a Samba 4 LDAP directory running on the same machine.
In the following console log notice that the output of "groups foo" changes. User foo is actually in four groups. After su'ing to foo all but one group are omitted. After restarting sssd they are remembered after a ten second delay.
root@ellen:/# date ; groups foo
Tue Sep 11 16:55:14 CEST 2012
foo : domusers devel publish domadmins
root@ellen:/# su -c pwd foo
/
root@ellen:/# date ; groups foo
Tue Sep 11 16:55:28 CEST 2012
foo : domusers
root@ellen:/# date ; groups foo
Tue Sep 11 16:56:31 CEST 2012
foo : domusers
root@ellen:/# date ; restart sssd
Tue Sep 11 16:56:35 CEST 2012
sssd start/running, process 2906
root@ellen:/# date ; groups foo
Tue Sep 11 16:56:38 CEST 2012
foo : domusers
root@ellen:/# date ; groups foo
Tue Sep 11 16:56:50 CEST 2012
foo : domusers devel publish domadmins
Here's another console log, this time using "getent group domadmins". Notice how the member foo disappears from the group after "su foo" and reappears exactly ten seconds after restarting sssd.
root@ellen:/# date +%T.%N ; getent group domadmins ; su -c pwd foo ; date +%T.%N ; getent group domadmins ; restart sssd ; sleep 1 ; date +%T.%N ; getent group domadmins ; sleep 8 ; while : ; do date +%T.%N ; getent group domadmins ; sleep 0.1 ; done
17:11:42.514625566
domadmins:
/
17:11:42.563576391
domadmins:*:512:bar
sssd start/running, process 3913
17:11:43.950506244
domadmins:*:512:bar
17:11:51.965140171
domadmins:*:512:bar
17:11:52.078101328
domadmins:*:512:bar
17:11:52.190149762
domadmins:*:512:bar
17:11:52.302006153
domadmins:*:512:bar
17:11:52.413620217
domadmins:*:512:bar
17:11:52.525430264
domadmins:*:512:bar
17:11:52.637152288
domadmins:*:512:bar
17:11:52.748823736
domadmins:*:512:bar
17:11:52.860533911
domadmins:*:512:bar
17:11:52.972191264
domadmins:*:512:bar
17:11:53.084747702
domadmins:
# dpkg -l sssd | grep ^ii
ii sssd 1.9.0~beta6-
# grep '\(group\
passwd: compat sss
group: compat sss
shadow: compat sss
netgroup: nis sss
root@ellen:/# cat /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
services = nss, pam
domains = SAMBA
[nss]
filter_groups = root
filter_users = root
[pam]
[domain/SAMBA]
description = Samba 4 Authentication Environment
enumerate = true
min_id = 500
id_provider = ldap
ldap_uri = ldap://192.168.1.2
ldap_tls_reqcert = never
ldap_tls_cacert = /etc/ssl/
ldap_schema = rfc2307bis
ldap_search_base = dc=cmpny,dc=nl
ldap_referrals = False
ldap_default_
ldap_default_
ldap_default_
ldap_user_
ldap_user_name = msSFU30Name
ldap_user_fullname = name
ldap_user_gecos = name
ldap_user_
ldap_user_
ldap_user_
ldap_user_shell = loginShell
ldap_user_principal = userPrincipalName
ldap_user_pwd = unixUserPassword
ldap_user_
ldap_group_
ldap_group_name = msSFU30Name
ldap_group_
ldap_group_pwd = unixUserPassword
ldap_group_
ldap_force_
auth_provider = krb5
chpass_provider = krb5
krb5_server = 192.168.1.2
krb5_kpasswd = 192.168.1.2
krb5_kdcip = 192.168.1.2
krb5_realm = CMPNY.COM
krb5_changepw_
krb5_ccachedir = /tmp
krb5_ccname_
summary: |
sssd forgets group memberships of foo when foo logs in; remembers them - after a while after restarting sssd + after ten seconds after restarting sssd |
tags: | added: quantal |
Without the SSSD logs it's hard to tell for certain, but I suspect this is caused by enumerate=True in the sssd.conf config file.
The reason why the groups seemingly appear after about ten seconds is that after the SSSD provider starts up, the enumerate task is scheduled. In general, it *should* block the NSS operations until the initial enumeration has completed, though.
Is the behaviour reproducable within a single SSSD session? In other words, if you log in after the ten seconds have passed and the getent command reports correct group memberships, does "groups" still show wrong membership?
Also, is there a particular reason to use enumerate=True?