Why does sssd return SID numbers instead of group names on Ubuntu?

Question

I'm trying out sssd to use krb5 for authentication on a Ubuntu 18.04 host and can't figure out how to show the actual user groups (groups shows some sort of Windows SID instead of human readable names). The primary group looks ok (Domain Users...) but the rest (supplementary) are all S-x-x-x numbers. Is this an AD setting or something with my sssd config?

$ groups
Domain Users@ad.mycorp.com S-1-5-21-944445629-1489980678-184074267-871221@ad.mycorp.com S-1-5-21-944445629-1489980678-184074267-871222@ad.mycorp.com...

sssd.conf

[nss]
   filter_groups        = root
   filter_users         = root
   reconnection_retries = 3

[pam]
   reconnection_retries = 3

[sssd]
   domains              = ad.mycorp.com
   config_file_version  = 2
   services             = nss, pam
   reconnection_retries = 3
   sbus_timeout         = 30

[domain/ad.mycorp.com]
   ad_domain            = ad.mycorp.com
   krb5_realm           = ad.mycorp.com
   realmd_tags          = manages-system joined-with-adcli
   cache_credentials    = True
   default_shell        = /bin/bash
   fallback_homedir     = /home/%d/%u

   krb5_store_password_if_offline   = True
   use_fully_qualified_names        = True

   ldap_sasl_authid     = UBU-TEST1$
   ldap_id_mapping      = True

   access_provider      = ldap
   id_provider          = ldap
   auth_provider        = krb5
   chpass_provider      = krb5

   ldap_uri             = ldaps://ad.mycorp.com
   ldap_search_base     = ou=mycorp,dc=mycorp,dc=com
   ldap_tls_cacert      = /etc/ssl/certs/ca-certificates.crt
   ldap_tls_reqcert     = allow
   dns_discovery_domain = ad.mycorp.com

   ldap_user_search_base   = ou=userid,ou=mycorp,dc=mycorp,dc=com
   ldap_group_search_base  = ou=mycorp,dc=mycorp,dc=com
   ldap_user_object_class  = user
   ldap_user_name          = sAMAccountName
   ldap_user_fullname      = displayName
   ldap_user_home_directory = unixHomeDirectory
   ldap_user_principal     = userPrincipalName
   ldap_group_object_class = group
   ldap_group_name         = sAMAccountName

   ldap_schema                = rfc2307bis
   ldap_access_order          = expire
   ldap_account_expire_policy = ad
   ldap_force_upper_case_realm = true

`ldap_id_mapping = true` Instructs sssd to generate group names based on the SID attribute so that seems expected behavior — Bob, Aug 17 '20 at 22:02
Ok so these aren't SIDs I'm seeing, but rather SSSD generated group names? How do I tell SSSD to just show the human readable group names from AD? — Server Fault, Aug 18 '20 at 17:01

score 1 · Answer 1 · edited Nov 13 '21 at 12:42

1

This is a bit old but I thought that I would share the solution that worked for me.

I solved this by adding a line to the sssd.conf file, in the [domain/example.local] section :

ad_server = <domain controller name>.example.local

and keep

ldap_id_mapping = True

edited Nov 13 '21 at 12:42

Dave M

4,514
22
31
30

answered Nov 11 '21 at 09:47

Volf

11
1

score 0 · Answer 2 · edited Aug 29 '20 at 20:22

0

ldap_id_mapping = false

This will fetch POSIX attributes from your AD.

If you set this option to True then sssd will generate UID ,GID from SID.

edited Aug 29 '20 at 20:22

Michael Hampton

244,070
43
506
972

answered Aug 19 '20 at 17:20

Nikhil Suryawanshi

1
1

I've set `ldap_id_mapping = false` with no effect. Viewing the group attributes in the AD (ADUC) Attribute Editor tab, the `sAMAccountName` attribute correctly holds the name of the group. I'm pretty sure sssd is using the `objectSid` attribute instead and ignoring the `ldap_group_name` setting in the configuration. – Server Fault Aug 20 '20 at 21:08

score 0 · Answer 3 · answered Sep 06 '20 at 09:01

0

Did you clear the sssd cache ? #systemctl stop sssd; rm -r /var/lib/sss/db/* ; systemctl start sssd

Make sure you have POSIX attributes set in AD. Could be verified by ldapsearch also.

answered Sep 06 '20 at 09:01

Nikhil Suryawanshi

1
1

Thanks. I did nuke `/var/lib/sss/db/*` last week and wasn't able to get things working again (eventually restored from a snapshot). Aha... `ldapsearch` doesn't show `gidNumber` or `uidNumber` attributes. I believe these may be sent over in the kerberos ticket somehow. I'm not terribly familiar with this system and still trying to find out who to talk to about it so still learning about it. ADUC shows the UNIX gid/uid numbers but they don't come through with `ldapsearch` which suggests I need to contact the AD admin. – Server Fault Sep 10 '20 at 14:54

Why does sssd return SID numbers instead of group names on Ubuntu?

3 Answers3