I have managed to login to an IPA client with a non-existing user. My AD user is z123456(a)addomain.mydomain.at and I have created a similar user called i123456(a)ipadomain.mydomain.at. What happened now is that I could log in with the i-User and what I get to see after logging in is this: [i123456@addomain.mydomain.at(a)as12314 ~]$ id uid=1246600007(i123456(a)addomain.mydomain.at) gid=1246600007(i123456(a)addomain.mydomain.at) groups=1246600007(i123456@addomain.mydomain.at),1246600016(my-ad-group(a)ipadomain.mydomain.at) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [i123456@addomain.mydomain.at(a)as12314 ~]$ whoami i123456(a)addomain.mydomain.at The user i123456(a)addomain.mydomain.at does NOT exist. addomain is set as default domain in the client's sssd.conf.

What is wrong here? Are things just displayed wrong or could it be more?

Which files do you need in order to analyze this issue?

On 16.04.19 10:50, Sumit Bose via FreeIPA-users wrote: > On Tue, Apr 16, 2019 at 09:06:44AM +0200, Ronald Wimmer via FreeIPA-users wrote: > > I have managed to login to an IPA client with a non-existing user. > > > > My AD user is z123456(a)addomain.mydomain.at and I have created a similar user > > called i123456(a)ipadomain.mydomain.at. What happened now is that I could log > > in with the i-User and what I get to see after logging in is this: > > > > [i123456@addomain.mydomain.at(a)as12314 ~]$ id > > uid=1246600007(i123456(a)addomain.mydomain.at) > > gid=1246600007(i123456(a)addomain.mydomain.at) groups=1246600007(i123456@addomain.mydomain.at),1246600016(my-ad-group(a)ipadomain.mydomain.at) > > context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 > > [i123456@addomain.mydomain.at(a)as12314 ~]$ whoami > > i123456(a)addomain.mydomain.at > > > > The user i123456(a)addomain.mydomain.at does NOT exist. > > > > addomain is set as default domain in the client's sssd.conf. > Does this change if you remove the default_domain_suffix option from the > client? Is this option set on the server as well? What is currently > displayed for the user on the server? > > In general default_domain_suffix should not be used anymore, better is > to define a domain lookup order on the IPA server. I could not reproduce it anymore. UID and GID of the user were correct. Maybe I used the POSIX group I mapped to an AD group in an incorrect way. The group had the actual AD group as an external member and I also added the IPA user (i123456) to this exact POSIX group. I bet that it is not recommended to do that?

Where should the domain lookup order on the IPA servers be specified?

On 16.04.19 11:29, Sumit Bose via FreeIPA-users wrote: > On Tue, Apr 16, 2019 at 11:12:18AM +0200, Ronald Wimmer via FreeIPA-users wrote: > > On 16.04.19 10:50, Sumit Bose via FreeIPA-users wrote: > > > On Tue, Apr 16, 2019 at 09:06:44AM +0200, Ronald Wimmer via FreeIPA-users wrote: > > > > I have managed to login to an IPA client with a non-existing user. > > > > > > > > My AD user is z123456(a)addomain.mydomain.at and I have created a similar user > > > > called i123456(a)ipadomain.mydomain.at. What happened now is that I could log > > > > in with the i-User and what I get to see after logging in is this: > > > > > > > > [i123456@addomain.mydomain.at(a)as12314 ~]$ id > > > > uid=1246600007(i123456(a)addomain.mydomain.at) > > > > gid=1246600007(i123456(a)addomain.mydomain.at) groups=1246600007(i123456@addomain.mydomain.at),1246600016(my-ad-group(a)ipadomain.mydomain.at) > > > > context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 > > > > [i123456@addomain.mydomain.at(a)as12314 ~]$ whoami > > > > i123456(a)addomain.mydomain.at > > > > > > > > The user i123456(a)addomain.mydomain.at does NOT exist. > > > > > > > > addomain is set as default domain in the client's sssd.conf. > > > Does this change if you remove the default_domain_suffix option from the > > > client? Is this option set on the server as well? What is currently > > > displayed for the user on the server? > > > > > > In general default_domain_suffix should not be used anymore, better is > > > to define a domain lookup order on the IPA server. > > I could not reproduce it anymore. UID and GID of the user were correct. > > Maybe I used the POSIX group I mapped to an AD group in an incorrect way. > > The group had the actual AD group as an external member and I also added the > > IPA user (i123456) to this exact POSIX group. I bet that it is not > > recommended to do that? > Do you mean this group is a POSIX group and an external group at the > same time? I think this is not recommended(supported?). Please add the > AD users and groups to external groups and then add the external groups > to POSIX groups. Nevertheless I think this is not the reason for the > wrong names you have seen. No. As the documentation advises I've created an external group that contains the AD group. After that, I created an IPA (POSIX) group that has the external group as a member. Additionally, I added an IPA user to that POSIX group. (Doing that I am mixing AD and IPA users in a group. Is it ok to do that?)