#3748 home dir disappear in sssd cache on the IPA master for AD users
Closed: Fixed a year ago Opened a year ago by sbose.

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1583251

Following an update to RHEL7.5, AD users home directory is set to '/'.
For example:

getent passwd <user>@<AD domain>
<user>@<AD domain>:*:988808870:988808870:<user name>:/:/bin/bash

Rebooting the IdM server fixes the issue, but it comes back after a while.

Metadata Update from @sbose:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1583251

a year ago

Metadata Update from @sbose:
- Issue assigned to sbose

a year ago

(Comment from BZ)
This issue is related to the magic private group (mpg) code which makes sure that with algorithmic id-mapping users from AD (sub-domain users) are automatically assigned a user private group. Since the private groups does not exists as a real group a lookup for this group uses a fallback to a user lookup.

If now the user private group is looked up while the cached user entry is exprired the backend first tries to find a matching group fails and falls back to a user lookup. Now two issues happen. First the user is looked up in the Global Catalog which will remove attribute from the cache which are not replicated to the Global Catalog, e.g. the shell or a home directory defined in AD. Second the code which adds the home directory attribute to the cache user object was not able to find the user object because the original request was a group lookup and the used call to search the cache was not aware of MPGs.

Reproducer:

[root@f26-ipa ~]# systemctl stop sssd.service ; rm -f /var/log/sssd/* ; rm -f /var/lib/sss/db/* ; systemctl start sssd.service                                                                                                                
[root@f26-ipa ~]# getent passwd tu1@ad.devel 
tu1@ad.devel:*:1367201104:1367201104:t u:/home/ad.devel/tu1:/bin/sh                                                                                                                                                                           
[root@f26-ipa ~]# sss_cache -E                                                                                                                                                                                                                
[root@f26-ipa ~]# getent group 1367201104                                                                                                                                                                                              
tu1@ad.devel:*:1367201104:                                                                                                                                                                                                                    
[root@f26-ipa ~]# getent passwd tu1@ad.devel                                                                                                                                                                                                  
tu1@ad.devel:*:1367201104:1367201104:t u:/:

Metadata Update from @jhrozek:
- Issue tagged with: PR, bug

a year ago

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.16.2

a year ago

Commit ad6ab35 relates to this ticket

Commit e66517d relates to this ticket

Commit 0322215 relates to this ticket

Commit 8aa56a9 relates to this ticket

Metadata Update from @jhrozek:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

a year ago

Login to comment on this ticket.

Metadata