SSSD fails to enumerate secondary Active Directory groups, "No tokenGroups entries for [user]"

Question

I've been trying to setup Active Directory integration on my ubuntu 16.04 host using Realmd/SSSD (SSSD version 1.13.4). I can login to the box as an AD user, and enumerating groups works with the command 'getent group ,' however, the setup is not properly enumerating the group memberships of users with the command 'id user@my.domain'.

I'll attach my configuration files and the relevant log files for SSSD (debugging level set to 9). As best that I can tell from parsing the log files, it seems that SSSD is failing to query tokenGroups for the user, claiming that the query returns no token groups.

I've verified that tokenGroups can be retrieved from the Windows Active Directory server by writing some basic .Net code that queries the tokenGroups attribute, and it correctly returns all the groups. However, SSSD seems to be running into a problem for one reason or the other. I believe my Active Directory uses schema rfc2307bis, and I've tried with that setting toggled on and off, both with ldap_group_member = member/uniqueMember, but it didn't change anything (furthermore, I don't think this affects the group lookup if SSSD is trying to use tokenGroups).

SSSD.conf:

[sssd]
domains = my.domain
config_file_version = 2
services = nss, pam
debug_level = 9

[nss]
debug_level = 9

[pam]
debug_level = 9

[domain/mydomain]
ad_domain = ad.utah.edu
krb5_realm = AD.UTAH.EDU
#Specifying the site is essential to avoid talking to firewalled DC servers
dns_discovery_domain = CAMPUS._sites.my.domain
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_sasl_authid = AD-INTEGRATION-$
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = simple
simple_allow_users = user1, user2, user3
simple_allow_groups = $
debug_level = 9

SSSD active directory log file:

(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_send] (0x4000): Retrieving info for initgroups call
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [DC=myDC=domain]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_print_server] (0x2000): Searching IP.IP.IP.IP
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=<myuserid>)(objectclass=user)(objectSID=*))][DC=myDC=domain].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixUserPassword]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixHomeDirectory]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPrincipalName]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [name]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectGUID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [primaryGroupID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [whenChanged]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 14
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_op_add] (0x2000): New operation 14 timeout 6
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d21d50], connected[1], ops[0x1d3c540], ldap[0x1d55a80]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=<myuserid>,OU=People,DC=myDC=domain].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [name]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectGUID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [primaryGroupID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectSid]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [sAMAccountName]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [userPrincipalName]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d21d50], connected[1], ops[0x1d3c540], ldap[0x1d55a80]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_op_destructor] (0x2000): Operation 14 finished
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_user] (0x4000): Receiving info for the user
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [ldb] (0x4000): start ldb transaction (nesting: 0)
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_user] (0x4000): Storing the user
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Save user
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_primary_name] (0x0400): Processing object <myuserid>
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Processing user <myuserid>
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x1000): Mapping user [<myuserid>] objectSID [S-1-5-21-1599696121-1964574698-334091239-36222] to unix ID
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x2000): Adding originalDN [CN=<myuserid>,OU=People,DC=myDC=domain] to attributes of [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Original memberOf is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): original mod-Timestamp is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Original USN value is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Adding user principal [<myuserid>@my.domain] to attributes of [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowLastChange is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowMin is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowMax is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowWarning is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowInactive is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowExpire is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowFlag is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): krbLastPwdChange is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): krbPasswordExpiration is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): pwdAttribute is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): authorizedService is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): adAccountExpires is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): adUserAccountControl is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): nsAccountLock is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): authorizedHost is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): ndsLoginDisabled is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): ndsLoginExpirationTime is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): ndsLoginAllowedTimeMap is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): sshPublicKey is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): authType is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): userCertificate is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sysdb_attrs_get_aliases] (0x2000): Domain is case-insensitive; will add lowercased aliases
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Storing info for user <myuserid>
...
...
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_user] (0x4000): Process user's groups
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_print_server] (0x2000): Searching IP.IP.IP.IP
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [no filter][CN=<myuserid>,OU=People,DC=myDC=domain].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [tokenGroups]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 13
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_op_add] (0x2000): New operation 13 timeout 6
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d21d50], connected[1], ops[(nil)], ldap[0x1d55a80]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d22e00], connected[1], ops[0x1dcd720], ldap[0x1d23110]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=<myuserid>,OU=People,DC=myDC=domain].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_entry] (0x1000): Entry has no attributes [0(Success)]!?
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d22e00], connected[1], ops[0x1dcd720], ldap[0x1d23110]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_op_destructor] (0x2000): Operation 13 finished
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_ad_tokengroups_done] (0x1000): No tokenGroups entries for [<myuserid>]

I'm happy to provide more logs, as well. I've tried doing a wireshark dump as well, but the LDAP packets are encrypted with SASL, and I had no luck giving the KRB5 keytab to wireshark to decrypt it (perhaps the keytab file is encrypted? Or perhaps wireshark needs the server keytab file? I had a hard time deciphering the wireshark documentation on the matter).

1) Did you try the schema type to be "AD"? 2) The AD attribute for a user's group membership is called "memberof" — strongline, Nov 20 '17 at 03:23

score 0 · Answer 1 · answered Nov 06 '18 at 21:23

The computer account that sssd is using probably doesn't have permission to read tokenGroups from your user objects. I've come across directories where the bulk of accounts do not have this permission. Accounts that don't have that permission granted don't get secondary groups; accounts with it do.

You can verify this for yourself by using ADSI Edit to view effective permissions the machine account has over the user object. Here is an account where sssd can see secondary groups:

Here is an account from a different OU in the same directory where sssd can't see secondary groups:

If you don't have access to modify the user objects, you can set ldap_use_tokengroups = false in [domain/mydomain].

A final word of advice: if your directory is huge, as unsanitized parts of your example configuration make me think yours is, set ignore_group_members = true or use a restrictive ldap_group_search_base to avoid five-minute delays when you run id. Unix group semantics fall down when handling groups with 100000+ members.

SSSD fails to enumerate secondary Active Directory groups, "No tokenGroups entries for [user]"

1 Answers1