Environment

• RHEL 7
• Freeipa (Red Hat idm) domain in trust with AD using posix attributes (uidnumber, gid, gidnumber etc.) defined in AD.
• AD has some users that do not belong to any posix groups, but have their gid (primary group) attribute defined to a common 'users' group.

Issue

When listing user that has no groups with 'id' command on client computer: 'no such user' is returned.

$ id r00a030
id: r00a030: no such user

After 15 seconds (after sssd negative cache timeout expires) 'id' command for same user correctly lists this user with its primary group.

$ id r00a030
uid=18648(r00a030) gid=200(users) groups=200(users)

Version/Release/Distribution

sssd-1.10.0-19.el7_5.5.x86_64

Additional info:

This seems to be an issue with sss_nss_getgrouplist_timeout function in src/sss_client/idmap/sss_nss_ex.c.

Actually the inconsistency originates in sss_get_ex function.

The first request is not found in cache so gets handled by sss_nss_make_request_timeout function. This returns with NSS_STATUS_SUCCESS but since num_results will be 0 sss_get_ex will return with ENOENT.

The subsequent request is in cache and is returned by sss_nss_mc_get and the return value is 0.

With the first request sss_nss_getgrouplist_timeout will return immediately with ENOENT. ngroup and group input parameters are not touched.

Subsequent times (due to good return value) sss_nss_getgrouplist will populate input parameters ngroup and group. These will only contain the primary gid number of the user as there are no other groups.

Would it be a good idea to make sss_nss_getgrouplist handle the ENOENT return value from sss_get_ex in a non-destructive way (ignore it) ?

GDB trace:

First attempt:

Breakpoint 2, sss_get_ex (inp=inp@entry=0x7fffffffe1e0, flags=flags@entry=0, timeout=timeout@entry=6316112) at src/sss_client/idmap/sss_nss_ex.c:170
170 {
(gdb) si
check_flags (skip_data=<synthetic pointer>, skip_mc=<synthetic pointer>, flags=<optimized out>, inp=<optimized out>) at src/sss_client/idmap/sss_nss_ex.c:116
116 && (flags & SSS_NSS_EX_FLAG_INVALIDATE_CACHE) != 0) {
(gdb) n
sss_get_ex (inp=inp@entry=0x7fffffffe1e0, flags=flags@entry=0, timeout=timeout@entry=6316112) at src/sss_client/idmap/sss_nss_ex.c:170
170 {
(gdb)
184 ret = check_flags(inp, flags, &skip_mc, &skip_data);
(gdb)
171 uint8_t *repbuf = NULL;
(gdb)
184 ret = check_flags(inp, flags, &skip_mc, &skip_data);
(gdb)
189 if (!skip_mc && !skip_data) {
(gdb)
190 ret = sss_nss_mc_get(inp);
(gdb)
193 return 0;
(gdb)
191 switch (ret) {
(gdb)
195 return ERANGE;
(gdb)
191 switch (ret) {
(gdb)
207 ret = sss_nss_timedlock(timeout, &time_left);
(gdb)
208 if (ret != 0) {
(gdb)
214 ret = sss_nss_mc_get(inp);
(gdb)
215 switch (ret) {
(gdb)
214 ret = sss_nss_mc_get(inp);
(gdb)
215 switch (ret) {
(gdb)
233 ret = sss_nss_make_request_timeout(inp->cmd, &inp->rd, time_left,
(gdb)
235 if (ret != NSS_STATUS_SUCCESS) {
(gdb)
241 SAFEALIGN_COPY_UINT32(&num_results, repbuf, NULL);
(gdb)
244 if (num_results == 0) {
(gdb)
245 ret = ENOENT;
(gdb)
318 free(repbuf);
(gdb)
320 sss_nss_unlock();
(gdb)
321 return ret;
(gdb)
322 }

Second attempt:

Breakpoint 2, sss_get_ex (inp=inp@entry=0x7fffffffe1e0, flags=flags@entry=0, timeout=timeout@entry=6316112) at src/sss_client/idmap/sss_nss_ex.c:170
170 {
(gdb) si
check_flags (skip_data=<synthetic pointer>, skip_mc=<synthetic pointer>, flags=<optimized out>, inp=<optimized out>) at src/sss_client/idmap/sss_nss_ex.c:116
116 && (flags & SSS_NSS_EX_FLAG_INVALIDATE_CACHE) != 0) {
(gdb) n
sss_get_ex (inp=inp@entry=0x7fffffffe1e0, flags=flags@entry=0, timeout=timeout@entry=6316112) at src/sss_client/idmap/sss_nss_ex.c:170
170 {
(gdb)
184 ret = check_flags(inp, flags, &skip_mc, &skip_data);
(gdb)
171 uint8_t *repbuf = NULL;
(gdb)
184 ret = check_flags(inp, flags, &skip_mc, &skip_data);
(gdb)
189 if (!skip_mc && !skip_data) {
(gdb)
190 ret = sss_nss_mc_get(inp);
(gdb)
193 return 0;
(gdb)
191 switch (ret) {
(gdb)
322 }