URL: https://github.com/SSSD/sssd/pull/5613
Title: #5613: ipa: read auto_private_groups from id range if available
sumit-bose commented:
"""
Hi,
thank you for the updates, I think lookups on the server-side now work as expected.
When testing on a client with POSIX IDs from AD in hybrid mode I came across an issue when looking up a GID generated via hybrid mode. This fails because the id_type is not set to `SSS_ID_TYPE_BOTH`. A patch like
```
diff --git a/src/responder/nss/nss_protocol_sid.c b/src/responder/nss/nss_protocol_sid.c
index 96cb8617b..b6292329b 100644
--- a/src/responder/nss/nss_protocol_sid.c
+++ b/src/responder/nss/nss_protocol_sid.c
@@ -76,7 +76,7 @@ nss_get_id_type(struct nss_cmd_ctx *cmd_ctx,
}
ret = find_sss_id_type(result->msgs[0],
- sss_domain_is_mpg(result->domain),
+ sss_domain_is_mpg(result->domain) || sss_domain_is_hybrid(result->domain),
_type);
if (ret != EOK) {
DEBUG(SSSDBG_OP_FAILURE,
diff --git a/src/util/domain_info_utils.c b/src/util/domain_info_utils.c
index 26e3ed054..7ceeb4242 100644
--- a/src/util/domain_info_utils.c
+++ b/src/util/domain_info_utils.c
@@ -966,6 +966,11 @@ bool sss_domain_is_mpg(struct sss_domain_info *domain)
return domain->mpg_mode == MPG_ENABLED;
}
+bool sss_domain_is_hybrid(struct sss_domain_info *domain)
+{
+ return domain->mpg_mode == MPG_HYBRID;
+}
+
enum sss_domain_mpg_mode get_domain_mpg_mode(struct sss_domain_info *domain)
{
return domain->mpg_mode;
diff --git a/src/util/util.h b/src/util/util.h
index e43b2863d..60ad2112f 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -625,6 +625,7 @@ void sss_domain_info_set_output_fqnames(struct sss_domain_info *domain,
bool sss_domain_info_get_output_fqnames(struct sss_domain_info *domain);
bool sss_domain_is_mpg(struct sss_domain_info *domain);
+bool sss_domain_is_hybrid(struct sss_domain_info *domain);
enum sss_domain_mpg_mode get_domain_mpg_mode(struct sss_domain_info *domain);
const char *str_domain_mpg_mode(enum sss_domain_mpg_mode mpg_mode);
```
fixed this for me. As a result all 3 modes with IDs from AD worked on a patched and un-patched client.
With auto-generated IDs in my testing `--auto-private-groups=false` only worked on a patched client. On an un-patched client it looks the mpg mode is more or less hardcoded, even setting `auto_private_groups` didn't help in my testing. As a result looking up a GID often fails with a 'multiple results found' error in the logs because the lookup finds the GID of the group but also user with the GID as primary GID.
If you do not have an idea how to make it work on un-patched clients I guess this must be documented carefully.
Finally, not strictly related to your patches, I think the `hybrid` mode make no sense for auto-generated IDs (`--range-type=ipa-ad-trust`), it should give the same results as `false` mode. So it might be worth it not allow to set it in this case at all in the ipa tools. What do you think?
bye,
Sumit
"""
See the full comment at https://github.com/SSSD/sssd/pull/5613#issuecomment-841385723