Cloned from Pagure issue: https://pagure.io/SSSD/sssd/issue/2051

• Created at 2013-08-21 16:09:10 by simo
• Closed as Fixed
• Assigned to simo

I was testing with id_provider = proxy and the files nss lib.
When trying to login we do an initgroups_dyn call to determine the group list.
This is done passing the user's primary group as an argument.
In this case glibc skips the user's group when it looks it up, resulting in the call returning NSS_STATUS_NOTFOUND if the user is member only of that specific group.
In this case we should not fail but simply consider that only group being available to be the user's primary group as returned by getpwnam.

As a temporary workaround I added the user to a new group and initgroups 'started working' again .

Comments

Comment from simo at 2013-08-21 16:10:12

Fields changed

description: I was testing with id_provider = proxy and the files nss lib.
When trying to login we do an initgroups_dyn call to determine the group list.
This is done passing the user's primary group as an argument.
In this case glibc skips the user's group when it looks it up, resulting in the call returning NSS_STATUS+NOTFOUND if the user is member only of that specific group.
In this case we should not fail but simply consider that only group being available to be the user's primary group as returned by getpwnam.

As a temporary workaround I added the user to a new group and initgroups 'started working' again . => I was testing with id_provider = proxy and the files nss lib.
When trying to login we do an initgroups_dyn call to determine the group list.
This is done passing the user's primary group as an argument.
In this case glibc skips the user's group when it looks it up, resulting in the call returning NSS_STATUS_NOTFOUND if the user is member only of that specific group.
In this case we should not fail but simply consider that only group being available to be the user's primary group as returned by getpwnam.

As a temporary workaround I added the user to a new group and initgroups 'started working' again .

Comment from simo at 2013-08-21 16:10:20

Fields changed

owner: somebody => simo
status: new => assigned

Comment from simo at 2013-08-21 16:18:10

This patch is untested but should work.

patch: 0 => 1

Comment from simo at 2013-08-21 19:20:15

new approach
0001-proxy-Allow-initgroup-to-return-NOTFOUND.patch

Comment from jhrozek at 2013-08-22 18:44:00

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.10.2

Comment from jhrozek at 2013-08-22 20:00:06

• master: 66d1f56
• sssd-1-10: d804bc1

resolution: => fixed
status: assigned => closed

Comment from dpal at 2013-09-12 16:37:30

Fields changed

rhbz: => 0

Comment from jhrozek at 2013-11-20 16:00:50

• sssd-1-9: dd2936e

Comment from simo at 2017-02-24 14:53:11

Metadata Update from @Simo:

• Issue assigned to simo
• Issue set to the milestone: SSSD 1.10.2