One thing I did notice in /var/log/messages:

Apr  5 22:07:53 name102 sssd[nss]: More groups have the same GID [12510] in directory server. SSSD will not work correctly.

That message is not present on hostB (the working host).

1.12 is really ancient, don't run that in production or really, anywhere else.

Can you resolve the HOSTGROUP as a netgroup (getent netgroup HOSTGROUP) ? How does the hostgroup look like on the server.

Thank you for the quick response.

I think i can upgrade to 1.13 on those systems but since it's 6.5 I don't think i have much choice. But i will look closer shortly.

Yes, i used getent last and got the 6 machines back (including the problem server). Also, i dumped the sssd cache and saw the same result there.

Also, why does None mean in this line:

(name102.sj2.hbase.crm.cnvr.net, *, (none)) NOT found in netgroup prd.dtm.hbase.name

Updated to sssd 1.13. Issue still there.

Looking at the source code, I see that unless the domain name is defined, it should be *. So, it appears that in the case of the non-working host, the domain name is literally '(none)', which will never match the domain returned from LDAP? If that's so, it's a mystery why getdomainname would return different values on the two hosts.

Running domainname in bash returns (none) on both.

I have good news to report. After playing with your C code and reading about innetgrp, I realized that its third parameter is the domain name. So the facts are:

• Both systems report (none) for domainname in Bash.
• The ''good'' system has * for the last parameter in innetgr, which means getdomainname returned NULL.
• The "bad" system has (none) for the domain name, which means getdomainname returned the literal string (none). In your code (sudo-1.8.6p3-netgrmatchtrace.patch) you have:

<snip>
+     sudo_debug_printf(SUDO_DEBUG_TRACE,
+                       "(%s, %s, %s) NOT found in netgroup %s\n",
+                       lhost ? lhost : "*",
+                       user ? user : "*",
+                       domain ? domain : "*",
+                       netgr);
</snip>

... which supports my theory

Having gathered those facts, I executed domainname OURDOMAIN and re-ran sudo, which worked!

I still don't know why the good system doesn't get fooled by the (none) return.

I've compiled a small C program (found it with a quick Google) to check getdomainname and it returned (none) on both.

/* gethostn.c:
 *
 * Example of gethostname(2):
 */
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>

int
main(int argc,char **argv) {
    int z;
    char buf[32];

    z = getdomainname(buf,sizeof buf);

    if ( z == -1 ) {
        fprintf(stderr,"%s: getdomainname(2)\n",
            strerror(errno));
        exit(1);
    }

    printf("domain name = '%s'\n",buf);

    return 0;
}

It returned (none) on both. But the good news is that we have a workaround now.

Hmm, I really don't know either. It sounds like you find the issue in sudo, so I would suggest to open an issue against sudo to ask there.

I'm closing this ticket, but thank you very much for debugging it.

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4713

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.