You should check your sssd_domain logs (sssd_ad.nwra.com.log) for a time when someone is being denied - search for hbac_eval_user_element and check the number it returns versus the number of AD groups that user belongs to.

If the problem is that sssd isn't getting the right number of groups, then updating to sssd version 1.15.3 will work. I don't know if or where that's packaged for ubuntu, sorry. I know it can be hard to reproduce, but if you can reproduce it, on the client do: - run the date command - run the login unsuccessfully (if it is indeed hbac for login) - run the date command. Then check the IPA logs for entries between the dates.

On 12 October 2017 at 08:35, Orion Poplawski <orion(a)nwra.com&gt; wrote: > On 10/06/2017 08:29 PM, Lachlan Musicman wrote: > > You should check your sssd_domain logs (sssd_ad.nwra.com.log) for a > time when > > someone is being denied - search for hbac_eval_user_element and check > the > > number it returns versus the number of AD groups that user belongs to. > > I've increased the logging to show this message now. We'll see if it > happens > again. > > > If the problem is that sssd isn't getting the right number of groups, > then > > updating to sssd version 1.15.3 will work. > > > > I don't know if or where that's packaged for ubuntu, sorry. > > > > I know it can be hard to reproduce, but if you can reproduce it, on the > client do: > > > > - run the date command > > - run the login unsuccessfully (if it is indeed hbac for login) > > - run the date command. > > > > Then check the IPA logs for entries between the dates. > > Just to be clear, what IPA logs do you mean? I'm assuming you're talking > about on the server? Or just the normal sssd logs on the client? >

Does access work from any RHEL/CentOS client? (I’m asking because as long as those are fully patched, all HBAC-related bugs should be fixed there)

There was a bug that we fixed in commit 88f6d8ad4eef4b4fa032fd451ad732cf8201b0bf in the sssd-1-13 branch that should help. However, that commit was not released as we didn’t release a 1.13.5 tarball yet (we should, but there are some pending regressions, see the pagure milestone for details). I think in the meantime the best way is to file an Ubuntu bug and ask the maintainer to apply 88f6d8ad4eef4b4fa032fd451ad732cf8201b0bf There should be no backporting necessary, the patch should apply cleanly.

> On 7 Oct 2017, at 00:37, Orion Poplawski <orion(a)nwra.com&gt; wrote: > > I just added my first ubuntu 16.04 client to our IPA domain and am having > problem with HBAC rules randomly denying access to a user that should have > access. Users are in AD (ad.nwra.com), I have an external group containing > the AD user linked to an IPA group used for the HBAC rule. Much of the time > it will work, but sometimes not. > > sssd.conf: > [domain/nwra.com] > cache_credentials = True > krb5_auth_timeout = 30 > krb5_store_password_if_offline = True > ipa_domain = nwra.com > id_provider = ipa > auth_provider = ipa > access_provider = ipa > chpass_provider = ipa > ipa_server = ipa.nwra.com, _srv_ > ldap_tls_cacert = /etc/ipa/ca.crt > dns_discovery_domain = nwra.com > timeout = 20 > debug_level = 5 > > [sssd] > services = nss, sudo, pam, ssh, autofs > domains = nwra.com > default_domain_suffix = ad.nwra.com > debug_level = 5 > > > This is with 1.13.4-1ubuntu1.8 > > Is there any hope for this version to work? Any reliable source for an > updated package? > > -- > Orion Poplawski > Technical Manager of NWRA Systems 720-772-5637 > NWRA, Boulder/CoRA Office FAX: 303-415-9702 > 3380 Mitchell Lane orion(a)nwra.com > Boulder, CO 80301 https://www.nwra.com/ > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org _______________________________________________ sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org