AD Users are bypassed due to groups when groups config option is set, regardless of group.

[elitegoodguy]

Summary

AD Users are bypassed due to groups when groups config option is set, regardless of group.

I'm trying to setup to allow my root user to login without 2FA (Yes I'll be disabling that once I get DUO working for my users and making root local login only) Every time I add the groups=XXXX line into the config I get "[6] User jdoe bypassed Duo 2FA due to user's UNIX group" Regardless of what information I put into groups. I can put groups=made_up_group_that_doesnt_exist and it will allow my user to bypass duo. If I have the groups line commented out it prompts me to authenticate with Duo.

Steps to reproduce

1. RHEL 8.5 system joined to AD environment for logins.
2. Specify group variable
3. Run login_duo -d

Specs

• OS version (ie CENTOS 7 or Ubuntu 14): RHEL 8.5
• OS arch (ie 32 or 64): 64
• Using pam_duo or login_duo: login_duo (login_duo 1.12.0)

[DuoKristina]

Hi @elitegoodguy,

What version of Duo Unix did you try this with? The most recent release?

Also, to make sure I understand your expectations, are you specifying a groupname or a !groupname?

groups=foo means only apply Duo 2FA to members of foo; users whose group membership does not include foo will bypass 2FA.

[elitegoodguy]

Sorry left that out... It's login_duo 1.12.0

That is correct I attempted groups=users,!wheel

For all users except for those in the wheel group. Maybe put the AD group that I am in? groups="Domain Users",!wheel ? I have not tried that yet.

[elitegoodguy]

I resolved it It was that it was allowing them through regardless of the group. You can either be included or excluded... If you are not in any group that's included you're automatically considered excluded and do not need to have 2fa. I found that once I added in a valid group name that I am 100% included then it works.

This works just fine for me because it says everyone on the domain needs duo 2fa to get into this server except for root. My login rules will lock it down further to restrict it to a certain group and allow root to login local only.

groups=domain\ users,!root

[AaronAtDuo]

@elitegoodguy Looks like you go this working to your satisfaction, so I'll close this out. Let us know if you run into any other issues, and thanks for using Duo!