group.of.nepali.translators team mailing list archive

[Timo Aaltonen <tjaalton@xxxxxxxxxx>]

should be fixed bionic and up

** Also affects: sssd (Ubuntu Xenial)
   Importance: Undecided
       Status: New

** Changed in: sssd (Ubuntu)
       Status: Triaged => Fix Released

** Changed in: sssd (Ubuntu Xenial)
       Status: New => Fix Committed

** Tags added: verification-needed verification-needed-xenial

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1722936

Title:
  sssd hbac rule applicaton for AD users is inconsistent

Status in sssd package in Ubuntu:
  Fix Released
Status in sssd source package in Xenial:
  Fix Committed

Bug description:
  [Impact]
  From the upstream bug at https://pagure.io/SSSD/sssd/issue/3382:
  """
  In IPA-AD trust environment, sssd is intermittently failing to map AD user
  group with IPA POSIX group hence getting access denied due to HBAC rules. The issue gets resolved automatically after certain time, without restarting the sssd service. i.e:

  The IPA HBAC code used to read the group members from the the
  originalMemberOf attribute value for performance reasons. However,
  especially on IPA clients trusting an AD domain, the originalMemberOf
  attribute value is often not synchronized correctly.
  """

  
  [Test Case]
  Coming up with a simple test case is not feasable. Even upstream wasn't able to reliably reproduce the issue in a controlled manner. My best suggestion is for affected users to try the updated package and observe if the incorrect access denied error stops happening.

  This involves setting up an AD server, a FreeIPA one, creating trust
  between them, and nested groups and HBAC rules. Upstream's description
  of such a scenario is at
  https://github.com/SSSD/sssd/pull/309#issuecomment-318037063

  [Regression Potential]
  The patch changes how group membership in this scenario is computed. It's a complex setup, and we are relying on a) patch has been applied upstream and backported to 1.13; b) user who reported this bug confirmed it fixed the issue with a custom build he did; c) upstream test suite passed; d) dep8 tests (new with this SRU) also pass.

  [Other Info]
  The scenario where the bug happens is too complex to reproduce in a test case, but does happen out in the wild according to this report and also in upstream's bug tracker. I decided to add the DEP8 tests to this update as well to give extra confidence in this and future updates, even though it doesn't exercise this bug in particular.

  [Original Description]
  NAME="Ubuntu"
  VERSION="16.04.3 LTS (Xenial Xerus)"

  sssd Version: 1.13.4-1ubuntu1.8

  I'm sometimes seeing AD users denied access to a machine due to HBAC
  access rules:

  (Tue Oct  3 04:11:09 2017) [sssd[be[nwra.com]]]
  [ipa_hbac_evaluate_rules] (0x0080): Access denied by HBAC rules

  Upstream suggest applying this commit:

  https://pagure.io/SSSD/sssd/c/88f6d8ad4eef4b4fa032fd451ad732cf8201b0bf

  That was made on the 1.13 branch but not yet released.  More here:

  https://lists.fedorahosted.org/archives/list/sssd-
  users@xxxxxxxxxxxxxxxxxxxxxx/message/YIHC2C6JDNQLYMW7K7IXQKKIIRMO3QER/

  I'm currently testing out a local package with this patch.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1722936/+subscriptions