Re: [SSSD-users] SSSD (1.11.6 with LDAP/Krb5 providers) Init group lookup failed.

Hello I also have a group issue on sssd 1.11.6 with LDAP/Krb5 provider. When I used sssd-1.9.2-129.el6_5.4.x86_64, I could get all belonging groups by "id" command. After I updated to sssd-1.11.6-1, I could get only primary group by "id" command. I needed to retrieve each group information by "getent group" command, After that I could get all belonging groups by "id" command. It looks like the initial group lookup failed on sssd-1.11.6-1. Is this behavior a bug or spec of version 1.11.6 or I missed something in configuration file ? I would appreciate your kind support. Reproduce Procedures ================ 1. Set up desired sssd version 2. Remove cache files # rm -f /var/lib/sss/db/cache* 3. Start sssd # sssd -i -d7 -c sssd.conf-LDAP 4. Check account information by "id" command # id shoji-lab 5. Check group information by "getent group" command # getent group G-Role-ISOps-Server 6. Check account information again. # id shoji-lab Test Result (sssd-1.9.2-129) ==================== [admin@jpbl0-in00-is16 ~]$ rpm -q sssd sssd-1.9.2-129.el6_5.4.x86_64 [admin@jpbl0-in00-is16 ~]$ id shoji-lab uid=20000(shoji-lab) gid=20002(Domain Users) groups=20002(Domain Users),20166(U-Role-ISOps-Server),20165(G-Role-ISOps-Server) [admin@jpbl0-in00-is16 ~]$ getent group G-Role-ISOps-Server G-Role-ISOps-Server:*:20165:shoji-lab,bmulvany-lab,banban-lab,test_shoji,mokbrian-lab,arionk-lab,bleej-lab,haughtoj-lab,tstevens-lab,dkeane-lab,danoneil-lab,srpenn-lab [admin@jpbl0-in00-is16 ~]$ id shoji-lab uid=20000(shoji-lab) gid=20002(Domain Users) groups=20002(Domain Users),20166(U-Role-ISOps-Server),20165(G-Role-ISOps-Server) Test Result (sssd-1.11.6-1) ==================== [admin@jpbl0-in00-is16 ~]$ id shoji-lab uid=20000(shoji-lab) gid=20002(Domain Users) groups=20002(Domain Users) [admin@jpbl0-in00-is16 ~]$ getent group G-Role-ISOps-Server G-Role-ISOps-Server:*:20165:shoji-lab,bmulvany-lab,banban-lab,test_shoji,mokbrian-lab,arionk-lab,bleej-lab,haughtoj-lab,tstevens-lab,dkeane-lab,danoneil-lab,srpenn-lab [admin@jpbl0-in00-is16 ~]$ id shoji-lab uid=20000(shoji-lab) gid=20002(Domain Users) groups=20002(Domain Users),20165(G-Role-ISOps-Server) Error Log Summary (sssd-1.11.6-1) ========================== (Fri Aug 8 03:30:18 2014) [sssd[nss]] [nss_memcache_initgr_check] (0x1000): Got request for [shoji-lab@labsso] (Fri Aug 8 03:30:18 2014) [sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 3 errno: 22 error message: Init group lookup failed (Fri Aug 8 03:30:18 2014) [sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data Provider Error: 3, 22, Init group lookup failed Will try to return what we have in cache (Fri Aug 8 03:30:18 2014) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x418450:3:shoji-lab@labsso] (Fri Aug 8 03:30:18 2014) [sssd[be[labsso]]] [acctinfo_callback] (0x0100): Request processed. Returned 3,22,Init group lookup failed (Fri Aug 8 03:30:18 2014) [sssd[nss]] [client_recv] (0x0200): Client disconnected! SSSD Configuration : Using LDAP/Krb5 providers ==================================== [sssd] config_file_version = 2 services = nss, pam, sudo domains = labsso [nss] [pam] [sudo] [domain/labsso] enumerate = false ldap_id_use_start_tls = False id_provider = ldap auth_provider = krb5 chpass_provider = krb5 krb5_realm = LABSSO.LABROOT.ISOPS.EXAMPLE.COM krb5_server = jpbw0-in00-is82.labsso.labroot.isops.example.com krb5_kpasswd = jpbw0-in00-is82.labsso.labroot.isops.example.com ldap_schema = rfc2307bis ldap_force_upper_case_realm = True ldap_user_object_class = person ldap_group_object_class = group ldap_user_gecos = displayName ldap_user_home_directory = unixHomeDirectory ldap_uri = ldap://jpbw0-in00-is82.labsso.labroot.isops.example.com ldap_search_base = DC=labsso,DC=labroot,DC=isops,DC=example,DC=com ldap_default_bind_dn = bindisops-lab(a)labsso.labroot.isops.example.com ldap_default_authtok_type = password ldap_default_authtok = password ldap_referrals = False LDAP Server (Active Directory) User/Group Hierarchy ======================================== shoji-lab (uid=20000, @LABSSO) G-Role-ISOps-Server (gid=20165, @LABSSO) U-Role-ISOps-Server (gid=20166, @LABSSO) Regards, Shoji Sugiyama