SSSD 无法枚举辅助 Active Directory 组，“没有 [用户] 的 tokenGroups 条目”

Question

我一直在尝试使用 Realmd/SSSD（SSSD 版本 1.13.4）在我的 ubuntu 16.04 主机上设置 Active Directory 集成。我可以以 AD 用户身份登录到该框，并且可以使用命令“getent group”枚举组，但是，该设置无法使用命令“id[电子邮件保护]“”。

我将附上我的配置文件和 SSSD 的相关日志文件（调试级别设置为 9）。据我分析日志文件得出的结论是，SSSD 似乎无法为用户查询 tokenGroups，并声称查询未返回 token 组。

我已经验证了可以通过编写一些查询 tokenGroups 属性的基本 .Net 代码从 Windows Active Directory 服务器检索 tokenGroups，并且它正确返回所有组。但是，SSSD 似乎因为这样或那样的原因遇到了问题。我相信我的 Active Directory 使用了架构 rfc2307bis，并且我尝试过打开和关闭该设置，都使用 ldap_group_member = member/uniqueMember，但它没有改变任何东西（此外，如果 SSSD 尝试使用 tokenGroups，我认为这不会影响组查找）。

SSSD.conf：

[sssd]
domains = my.domain
config_file_version = 2
services = nss, pam
debug_level = 9

[nss]
debug_level = 9

[pam]
debug_level = 9

[domain/mydomain]
ad_domain = ad.utah.edu
krb5_realm = AD.UTAH.EDU
#Specifying the site is essential to avoid talking to firewalled DC servers
dns_discovery_domain = CAMPUS._sites.my.domain
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_sasl_authid = AD-INTEGRATION-$
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = simple
simple_allow_users = user1, user2, user3
simple_allow_groups = $
debug_level = 9

SSSD 活动目录日志文件：

(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_send] (0x4000): Retrieving info for initgroups call
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [DC=myDC=domain]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_print_server] (0x2000): Searching IP.IP.IP.IP
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=<myuserid>)(objectclass=user)(objectSID=*))][DC=myDC=domain].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixUserPassword]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixHomeDirectory]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPrincipalName]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [name]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectGUID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [primaryGroupID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [whenChanged]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 14
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_op_add] (0x2000): New operation 14 timeout 6
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d21d50], connected[1], ops[0x1d3c540], ldap[0x1d55a80]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=<myuserid>,OU=People,DC=myDC=domain].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [name]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectGUID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [primaryGroupID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectSid]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [sAMAccountName]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [userPrincipalName]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d21d50], connected[1], ops[0x1d3c540], ldap[0x1d55a80]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_op_destructor] (0x2000): Operation 14 finished
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_user] (0x4000): Receiving info for the user
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [ldb] (0x4000): start ldb transaction (nesting: 0)
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_user] (0x4000): Storing the user
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Save user
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_primary_name] (0x0400): Processing object <myuserid>
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Processing user <myuserid>
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x1000): Mapping user [<myuserid>] objectSID [S-1-5-21-1599696121-1964574698-334091239-36222] to unix ID
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x2000): Adding originalDN [CN=<myuserid>,OU=People,DC=myDC=domain] to attributes of [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Original memberOf is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): original mod-Timestamp is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Original USN value is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Adding user principal [<myuserid>@my.domain] to attributes of [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowLastChange is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowMin is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowMax is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowWarning is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowInactive is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowExpire is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowFlag is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): krbLastPwdChange is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): krbPasswordExpiration is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): pwdAttribute is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): authorizedService is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): adAccountExpires is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): adUserAccountControl is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): nsAccountLock is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): authorizedHost is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): ndsLoginDisabled is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): ndsLoginExpirationTime is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): ndsLoginAllowedTimeMap is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): sshPublicKey is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): authType is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): userCertificate is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sysdb_attrs_get_aliases] (0x2000): Domain is case-insensitive; will add lowercased aliases
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Storing info for user <myuserid>
...
...
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_user] (0x4000): Process user's groups
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_print_server] (0x2000): Searching IP.IP.IP.IP
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [no filter][CN=<myuserid>,OU=People,DC=myDC=domain].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [tokenGroups]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 13
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_op_add] (0x2000): New operation 13 timeout 6
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d21d50], connected[1], ops[(nil)], ldap[0x1d55a80]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d22e00], connected[1], ops[0x1dcd720], ldap[0x1d23110]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=<myuserid>,OU=People,DC=myDC=domain].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_entry] (0x1000): Entry has no attributes [0(Success)]!?
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d22e00], connected[1], ops[0x1dcd720], ldap[0x1d23110]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_op_destructor] (0x2000): Operation 13 finished
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_ad_tokengroups_done] (0x1000): No tokenGroups entries for [<myuserid>]

我也很乐意提供更多日志。我也尝试过进行 wireshark 转储，但 LDAP 数据包使用 SASL 加密，我无法将 KRB5 密钥表提供给 wireshark 进行解密（也许密钥表文件已加密？或者 wireshark 需要服务器密钥表文件？我很难破译有关此事的 wireshark 文档）。

Answer 1

sssd 使用的计算机帐户可能没有读取权限tokenGroups您的用户对象。我遇到过大多数帐户没有此权限的目录。未获得该权限的帐户不会获得次要组；而拥有该权限的帐户则可以。

您可以使用 ADSI Edit 查看计算机帐户对用户对象的有效权限来亲自验证这一点。以下是 sssd 可以看到辅助组的帐户：

这是来自同一目录中不同 OU 的帐户，sssd 无法在其中看到次要组：

如果您无权修改用户对象，您可以设置ldap_use_tokengroups = false在 中进行设置[domain/mydomain]。

最后一条建议：如果你的目录很大，就像你示例配置中未清理的部分让我认为你的目录很大一样，请设置ignore_group_members = true或使用限制性措施，ldap_group_search_base以避免运行时出现五分钟的延迟id。处理具有 100000 多个成员的组时，Unix 组语义会失效。