Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

/etc/group.cache lists group members with distinguished name instead of username #35

Closed
jaqx0r opened this issue Mar 14, 2015 · 10 comments
Closed

/etc/group.cache lists group members with distinguished name instead of username #35

jaqx0r opened this issue Mar 14, 2015 · 10 comments
Labels
Priority-Medium Type-Defect

Comments

@jaqx0r
Copy link
Contributor

jaqx0r commented Mar 14, 2015

Original issue 34 created by jaqx0r on 2014-09-07T08:33:27.000Z:

What steps will reproduce the problem?
1.Group definition in LDAP
dn: cn=thglanzm,ou=Groups,dc=domain,dc=de
objectClass: posixGroup
cn: thglanzm
gidNumber: 10074
memberUid: uid=thglanzm,ou=People,dc=domain,dc=de
structuralObjectClass: posixGroup
entryUUID: f3fffb3c-8994-1033-82c3-d574d9524b6e
creatorsName: cn=manager,dc=domain,dc=de
createTimestamp: 20140616112732Z
entryCSN: 20140616112732.904794Z# 000000# 000# 000000
modifiersName: cn=manager,dc=domain,dc=de
modifyTimestamp: 20140616112732Z

  1. Nsscache Configuration:
    [DEFAULT]
    source = ldap
    cache = files
    maps = passwd, group, shadow, sshkey
    timestamp_dir = /var/lib/nsscache
    ldap_uri = ldap://ldap1
    ldap_base = dc=domain,dc=de
    ldap_filter = (objectclass=posixAccount)
    ldap_bind_dn = "cn=pam,dc=domain,dc=de"
    ldap_bind_password = "password"
    nssdb_dir = /var/lib/misc
    files_dir = /etc
    files_cache_filename_suffix = cache

[passwd]
ldap_base = ou=People,dc=domain,dc=de

[group]
ldap_base = ou=Groups,dc=domain,dc=de
ldap_filter = (objectclass=posixGroup)
rfc2307bis = 1

[shadow]
ldap_filter = (objectclass=shadowAccount)

[sshkey]
ldap_base = ou=People,dc=domain,dc=de

  1. Run nsscache update and cat /etc/group
    grep ^thglanzm /etc/group.cache
    thglanzm:*:10074:uid=thglanzm,ou=People,dc=domain,dc=de

What is the expected output? What do you see instead?

Expected Output:
grep ^thglanzm /etc/group.cache
thglanzm:*:10074:thglanzm

I see instead:
grep ^thglanzm /etc/group.cache
thglanzm:*:10074:uid=thglanzm,ou=People,dc=domain,dc=de

What version of the product are you using? On what operating system?

I used the latest release nsscache-0.23.tar.gz and the git head as of
2014-09-07.

Please provide any additional information below.

I wrote a small patch which I assume is wrong because it fights the symptoms instead of removes the root cause. Can someone who knows python and knows the code base better, please write a proper patch?
@jaqx0r
Copy link
Contributor Author

jaqx0r commented Mar 14, 2015

Comment #1 originally posted by jaqx0r on 2014-10-20T04:32:15.000Z:

I see you have rfc2370bis = 1 in the config; does that actually work?

@jaqx0r
Copy link
Contributor Author

jaqx0r commented Mar 14, 2015

Comment #2 originally posted by jaqx0r on 2014-10-20T04:42:26.000Z:

It seems that if the patch in # 8 was included, then there's no groups support for 2307bis (yet)

@jaqx0r
Copy link
Contributor Author

jaqx0r commented Mar 14, 2015

Comment #3 originally posted by jaqx0r on 2014-10-20T05:09:45.000Z:

I think this is working as unintended -- nsscache doesn't support rfc2307bis out of the box, but this shold be fixed soon.

@jaqx0r
Copy link
Contributor Author

jaqx0r commented Mar 14, 2015

Comment #4 originally posted by jaqx0r on 2014-10-20T05:10:22.000Z:

Fixed in github master.

@jaqx0r jaqx0r closed this as completed Mar 14, 2015
@oregszun
Copy link

oregszun commented Aug 4, 2016

Hello,

I have just checked out the master branch and built nsscache, and the issue mentioned here still persists!
The /etc/group.cache lists group members with distinguished name instead of username.
This is the same scenario as the earlier reporter used.

Has not been fixed already?

@jaqx0r
Copy link
Contributor Author

jaqx0r commented Aug 5, 2016

Please share your configuration and the command line you used, an example
ldif of one record from LDAP. Also you could enable debug log output and
see if you can see a suitable error message.

On Thu, 4 Aug 2016, 18:29 oregszun notifications@github.com wrote:

Hello,

I have just checked out the master branch and built nsscache, and the
issue mentioned here still persists!
The /etc/group.cache lists group members with distinguished name instead
of username.
This is the same scenario as the earlier reporter used.

Has not been fixed already?

—
You are receiving this because you modified the open/close state.
Reply to this email directly, view it on GitHub
#35 (comment), or mute
the thread
https://github.com/notifications/unsubscribe-auth/AC5b-2Oi0uqjoPFh7cfTMGlR-1HDVpmaks5qcaLfgaJpZM4JcdXf
.

@oregszun
Copy link

oregszun commented Aug 5, 2016 •
edited
Loading

nsscache.conf

[DEFAULT]
source = ldap
cache = files
maps = passwd, group, shadow, sshkey
timestamp_dir = /var/lib/nsscache
ldap_uri = ldap://w.x.y.z
ldap_base = dc=whatever,dc=com
ldap_filter = (objectclass=posixAccount)
ldap_bind_dn = "cn=Manager,dc=whatever,dc=com"
ldap_bind_password = ******
ldap_rfc2307bis = 0
ldap_rfc2307bis_alt = ?
ldap_debug = 3

nssdb_dir = /var/lib/misc
files_dir = /etc
files_cache_filename_suffix = cache

[passwd]
ldap_base = ou=People,dc=whatever,dc=com

[group]
ldap_base = ou=Groups,dc=whatever,dc=com
ldap_filter = (objectclass=posixGroup)

[shadow]
ldap_base = ou=People,dc=whatever,dc=com
ldap_filter = (objectclass=shadowAccount)

[sshkey]
ldap_base = ou=People,dc=whatever,dc=com
ldap_filter = (objectclass=ldapPublicKey)

@oregszun
Copy link

oregszun commented Aug 5, 2016

dn: cn=whatever-ldap,ou=Groups,dc=whatever,dc=com
objectClass: posixGroup
cn: whatever-ldap
gidNumber: 5002
memberUid: uid=user1,ou=People,dc=whatever,dc=com
memberUid: uid=user2,ou=People,dc=whatever,dc=com
memberUid: uid=user3,ou=People,dc=whatever,dc=com
memberUid: uid=user4,ou=People,dc=whatever,dc=com
...

@oregszun
Copy link

oregszun commented Aug 5, 2016 •
edited
Loading

ldap_rfc2307bis_alt = 1

[root@build nsscache]# nsscache -v update
INFO:NSSCacheApp:using nss_cache library, version 0.32
INFO:config:Configured maps are: passwd, group, shadow, sshkey
INFO:Update:Updating and verifying passwd cache.
INFO:Update:Updating and verifying passwd cache.
INFO:MapUpdater:Missing previous timestamp, defaulting to a full sync.
INFO:Update:Updating and verifying group cache.
INFO:Update:Updating and verifying group cache.
INFO:MapUpdater:Missing previous timestamp, defaulting to a full sync.
INFO:Update:Updating and verifying shadow cache.
INFO:Update:Updating and verifying shadow cache.
INFO:MapUpdater:Missing previous timestamp, defaulting to a full sync.
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:Update:Updating and verifying sshkey cache.
INFO:Update:Updating and verifying sshkey cache.
INFO:MapUpdater:Missing previous timestamp, defaulting to a full sync.
INFO:NSSCacheApp:Exiting nsscache with value 0 runtime 0.070000

[root@build ~]# head -n 1 /etc/group.cache
whatever-ldap:*:5002:
[root@build ~]#

No members at all.

@oregszun
Copy link

oregszun commented Aug 5, 2016 •
edited
Loading

ldap_rfc2307bis_alt = 0

[root@build nsscache]# nsscache -v update
INFO:NSSCacheApp:using nss_cache library, version 0.32
INFO:config:Configured maps are: passwd, group, shadow, sshkey
INFO:Update:Updating and verifying passwd cache.
INFO:Update:Updating and verifying passwd cache.
INFO:MapUpdater:Missing previous timestamp, defaulting to a full sync.
INFO:Update:Updating and verifying group cache.
INFO:Update:Updating and verifying group cache.
INFO:MapUpdater:Missing previous timestamp, defaulting to a full sync.
INFO:Update:Updating and verifying shadow cache.
INFO:Update:Updating and verifying shadow cache.
INFO:MapUpdater:Missing previous timestamp, defaulting to a full sync.
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:root:Ignored password that was not in crypt format
INFO:Update:Updating and verifying sshkey cache.
INFO:Update:Updating and verifying sshkey cache.
INFO:MapUpdater:Missing previous timestamp, defaulting to a full sync.
INFO:NSSCacheApp:Exiting nsscache with value 0 runtime 0.080000

[root@build ~]# head -n 1 /etc/group.cache
whatever-ldap:*:5002:uid=user1,ou=People,dc=whatever,dc=com,uid=user2,ou=People,dc=whatever,dc=com,uid=user3...

DN showed as member.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Priority-Medium Type-Defect
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@jaqx0r @oregszun