Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SSSD is not fully registering the domains if the cache is empty #7250

Closed
sumit-bose opened this issue Mar 20, 2024 · 5 comments
Closed

SSSD is not fully registering the domains if the cache is empty #7250

sumit-bose opened this issue Mar 20, 2024 · 5 comments
Labels
Bugzilla Closed: Fixed Issue was closed as fixed.

Comments

@sumit-bose
Copy link
Contributor

sumit-bose commented Mar 20, 2024 •
edited
Loading

This issue is cloned from https://issues.redhat.com/browse/RHEL-27716

What were you trying to do that didn't work?

SSSD is not fully registering the domains
if the cache is empty as a result id lookup is not showing all the groups that the user belongs to.


Expected results

id lookup should show the full group membership of the user.
Actual results

Missing group membership.
@sumit-bose
Copy link
Contributor Author

Hi,

this issue should be reproducible with a grand-child domain. The issue is in the fallback code which is called if there is no domain object for the forest root stored in the LDAP tree of the local domain. Iirc a grand-child domain will only have information about its parent (the child-domain) but not about the forest root stored in the LDAP tree.

When joined to the grand-child domain and started with an empty cache looking up a user from the forest root with the id command secondary groups will be missing and in the SSSD domain log there will be messages like

[sdap_save_user] (0x0400): SID S-1-5-21-12345678-23456789-8765432-1234 does not belong to any known domain

where the domain-SID part of the SID is the one of the forest root.

bye,
Sumit

sumit-bose added a commit to sumit-bose/sssd that referenced this issue Mar 20, 2024
@sumit-bose
ad: refresh root domain when read directly
c8115e9 
If the domain object of the forest root domain cannot be found in the
LDAP tree of the local AD domain SSSD tries to read the request data
from an LDAP server of the forest root domain directly. After reading
this data the information is stored in the cache but currently the
information about the domain store in memory is not updated with the
additional data. As a result e.g. the domain SID is missing in this data
and only becomes available after a restart where it is read from the
cache.

With this patch an unconditional refresh is triggered at the end of the
fallback code path.

Resolves: SSSD#7250
@sumit-bose sumit-bose mentioned this issue Mar 20, 2024
Closed
@joakim-tjernlund
Copy link
Contributor

I have seen this too. Had to delete the sssd cache to get my groups back

@alexey-tikhonov
Copy link
Member

Hi @joakim-tjernlund,

I have seen this too. Had to delete the sssd cache to get my groups back

would you be able to test patches from #7251?

@joakim-tjernlund
Copy link
Contributor

Hi @joakim-tjernlund,

I have seen this too. Had to delete the sssd cache to get my groups back

would you be able to test patches from #7251?

Not really, I cannot force it

sumit-bose added a commit to sumit-bose/sssd that referenced this issue Apr 23, 2024
@sumit-bose
ad: refresh root domain when read directly
4c66508 
If the domain object of the forest root domain cannot be found in the
LDAP tree of the local AD domain SSSD tries to read the request data
from an LDAP server of the forest root domain directly. After reading
this data the information is stored in the cache but currently the
information about the domain store in memory is not updated with the
additional data. As a result e.g. the domain SID is missing in this data
and only becomes available after a restart where it is read from the
cache.

With this patch an unconditional refresh is triggered at the end of the
fallback code path.

Resolves: SSSD#7250
alexey-tikhonov pushed a commit that referenced this issue Apr 23, 2024
@sumit-bose @alexey-tikhonov
ad: refresh root domain when read directly
db27a51 
If the domain object of the forest root domain cannot be found in the
LDAP tree of the local AD domain SSSD tries to read the request data
from an LDAP server of the forest root domain directly. After reading
this data the information is stored in the cache but currently the
information about the domain store in memory is not updated with the
additional data. As a result e.g. the domain SID is missing in this data
and only becomes available after a restart where it is read from the
cache.

With this patch an unconditional refresh is triggered at the end of the
fallback code path.

Resolves: #7250

Reviewed-by: Dan Lavu <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
(cherry picked from commit 0de6c33)
@alexey-tikhonov
Copy link
Member

Pushed PR: #7251

  • master
    • 0de6c33 - ad: refresh root domain when read directly
  • sssd-2-9
    • db27a51 - ad: refresh root domain when read directly

@alexey-tikhonov alexey-tikhonov added the Closed: Fixed Issue was closed as fixed. label Apr 23, 2024
@sumit-bose sumit-bose mentioned this issue Sep 25, 2024
Closed
alexey-tikhonov pushed a commit to alexey-tikhonov/sssd that referenced this issue Nov 13, 2024
@sumit-bose @alexey-tikhonov
ad: refresh root domain when read directly
196b55a 
If the domain object of the forest root domain cannot be found in the
LDAP tree of the local AD domain SSSD tries to read the request data
from an LDAP server of the forest root domain directly. After reading
this data the information is stored in the cache but currently the
information about the domain store in memory is not updated with the
additional data. As a result e.g. the domain SID is missing in this data
and only becomes available after a restart where it is read from the
cache.

With this patch an unconditional refresh is triggered at the end of the
fallback code path.

Resolves: SSSD#7250

Reviewed-by: Dan Lavu <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
(cherry picked from commit 0de6c33)
(cherry picked from commit db27a51)
alexey-tikhonov pushed a commit to alexey-tikhonov/sssd that referenced this issue Nov 15, 2024
@sumit-bose @alexey-tikhonov
ad: refresh root domain when read directly
8f99e5e 
If the domain object of the forest root domain cannot be found in the
LDAP tree of the local AD domain SSSD tries to read the request data
from an LDAP server of the forest root domain directly. After reading
this data the information is stored in the cache but currently the
information about the domain store in memory is not updated with the
additional data. As a result e.g. the domain SID is missing in this data
and only becomes available after a restart where it is read from the
cache.

With this patch an unconditional refresh is triggered at the end of the
fallback code path.

Resolves: SSSD#7250

Reviewed-by: Dan Lavu <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
(cherry picked from commit 0de6c33)
(cherry picked from commit db27a51)
alexey-tikhonov pushed a commit to alexey-tikhonov/sssd that referenced this issue Nov 15, 2024
@sumit-bose @alexey-tikhonov
ad: refresh root domain when read directly
1a43e62 
If the domain object of the forest root domain cannot be found in the
LDAP tree of the local AD domain SSSD tries to read the request data
from an LDAP server of the forest root domain directly. After reading
this data the information is stored in the cache but currently the
information about the domain store in memory is not updated with the
additional data. As a result e.g. the domain SID is missing in this data
and only becomes available after a restart where it is read from the
cache.

With this patch an unconditional refresh is triggered at the end of the
fallback code path.

Resolves: SSSD#7250

Reviewed-by: Dan Lavu <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
(cherry picked from commit 0de6c33)
(cherry picked from commit db27a51)
alexey-tikhonov pushed a commit to alexey-tikhonov/sssd that referenced this issue Nov 15, 2024
@sumit-bose @alexey-tikhonov
ad: refresh root domain when read directly
c012186 
If the domain object of the forest root domain cannot be found in the
LDAP tree of the local AD domain SSSD tries to read the request data
from an LDAP server of the forest root domain directly. After reading
this data the information is stored in the cache but currently the
information about the domain store in memory is not updated with the
additional data. As a result e.g. the domain SID is missing in this data
and only becomes available after a restart where it is read from the
cache.

With this patch an unconditional refresh is triggered at the end of the
fallback code path.

Resolves: SSSD#7250

Reviewed-by: Dan Lavu <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
(cherry picked from commit 0de6c33)
(cherry picked from commit db27a51)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bugzilla Closed: Fixed Issue was closed as fixed.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

ad: refresh root domain when read directly sumit-bose/sssd
3 participants
@joakim-tjernlund @sumit-bose @alexey-tikhonov