On ti, 19 touko 2020, Mark Potter via FreeIPA-users wrote:
While I have seen similar posts to the list while digging through the
archive, I cannot find this question specifically answered. We are coming
from OpenLDAP and migrating to FreeIPA on CentOS 7.5. We are using indirect
memberships to make this migration easier as we are moving from an
organically grown OpenLDAP to a very structured FreeIPA implementation.
What seems to be happening is that indirect memberships don't show using
the standard Linux tools. Using either "id" or "groups" doesn't
show any
indirect memberships yet the permissions seem to still work properly. This
is causing some confusion with our team.
Group B is a member of Group A and the user is also a direct member of
groups C and D. When using "id" for a given user it returns B, C, D and
not A. However I can create a file owned by user root and group A with 550
permissions and the user can view the contents of the file. "ipa user-show"
shows the proper memberships with A being an indirect membership.
Is this the expected behavior when using indirect memberships? If so, does
one abandon the standard CLI tool and use only ipa commands? I am fully
aware this could be a configuration issue but I have yet to find the
correct configuration to expose indirect membership to the standard Linux
tools.
Can you give more concrete logs and examples? Are all of those A, B, C, D groups
are POSIX groups, e.g. they have gidNumber assigned? I don't need to see
the whole entries for them but at least enough output of
$ ipa group-show A --all --raw
that shows 'member' for a user and indirect group membership, along with
'objectclass' list and gidNumber. Same for B, C, D groups.
Please also use SSSD troubleshooting guide to generate debug logs that show
which groups the user actually belongs to during the request you did
(like 'id ..').
https://sssd.github.io/docs/users/troubleshooting.html
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland