SSSD Configuration - Missing Group Memberships

[p-e-t-e-r10]

Hello @justin-stephenson @sumit-bose ,

I am configuring SSSD against Active Directory, and when I run id mako2, I get the following output:

id mako2  
uid=659262017(mako2) gid=659200513(Domain Users) groups=659200513(Domain Users)

However, when I run ldapsearch, I get the following details:

dn: CN=Peter Mako,OU=2021,OU=Studenti,OU=People,DC=fri,DC=uniza,DC=sk  
...
memberOf: CN=studenti_Ing,OU=Groups,DC=fri,DC=uniza,DC=sk  
memberOf: CN=studenti,OU=Groups,DC=fri,DC=uniza,DC=sk  
...

As you can see, the memberOf attribute in LDAP clearly shows that the user is a member of studenti and studenti_Ing groups, but these groups do not appear when using the id command.

Could you please advise on which parameters I need to add to my SSSD configuration to correctly retrieve and display these group memberships?

I am attaching the output of ldapsearch as well as my SSSD configuration file for reference.

OUTPUT_LDAPSEARCH.txt

Thank you!

Best regards,
Peter

[alexey-tikhonov]

Why do you use 'id_provider = ldap' and not 'id_provider = ad'?

[p-e-t-e-r10]

If I use id_provider = ldap or id_provider = ad it does not matter, because output is the same. But I changed id_provider to ad already. It's probably better...

[alexey-tikhonov]

Is this host enrolled into AD domain?

[alexey-tikhonov]

Is this host enrolled into AD domain?

Note that SSSD doesn't read 'memberOf' user attributes from the LDAP server.
It searches groups that a given member is user of, using a method that depends on 'id_provider' value.
For AD it is tokenGroups by default.

[p-e-t-e-r10]

Is this host enrolled into AD domain?

Yes it is

[p-e-t-e-r10]

Is this host enrolled into AD domain?

Note that SSSD doesn't read 'memberOf' user attributes from the LDAP server. It searches groups that a given member is user of, using a method that depends on 'id_provider' value. For AD it is tokenGroups by default.

Okey so what should i do? Which parameter should I set? BTW I must use 'id_provider = ldap' because when I use 'id_provider = ad' in logs I see message Permission denied, I am not user with admin privilligies

thanks
Peter

[alexey-tikhonov]

If host is indeed enrolled (i.e. there is a keytab with host keys) then try to use 'id_provider = ad' and do not specify other '*_provider' (it will default to ad).

[alexey-tikhonov]

Btw, tickets are meant for bug reports, not for asking a help with configuration.