RHEL6.6 sssd (1.11) doesn't return all group memberships against an IPA server

Solution Verified - Updated -

Environment

  • Red Hat Enterprise Linux 6
  • Identity Management
  • sssd-1.11.6-30

Issue

  • After upgrading system from RHEL 6.4 to RHEL 6.6, sudo commands through IPA stop working. On RHEL 6.4 it worked fine.

Resolution

  1. Enable enumerate in sssd configuration:

    [domain/$domain]
enumerate = TRUE

  2. Disable tokengroups in sssd configuration:

    [domain/$domain]
ldap_use_tokengroups = False

  3. Turn off dereference lookups

    [domain/$domain]
ldap_deref_threshold = 0

  • After making the above changes in /etc/sssd/sssd.conf , run sss_cache -E or manually delete the cache and restart sssd for changes to become effective.

  • Note: Only one of the workarounds should be applied at a time

Root Cause

  • Version 1.11 process roles, permissions and privileges as groups since those objects have objectClass groupOfNames, and includes support for tokengroups as a speed improvement and has been enabled by default, causing failures in some corner cases.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.