rpms/sssd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Failed to resolve indirect group-members of nested non-POSIX group

Browse Source 
Resolves: RHEL-148232
This commit is contained in:
Tomas Halman 2026-04-02 11:09:20 +02:00
parent 5c9eab4125
commit 86a917d3d1
2 changed files with 84 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
0001-do-not-require-GID-for-non-POSIX-group.patch Normal file
View File

@ -0,0 +1,79 @@
Based on 7aa7344a20b3b31ae53ea790801254af42d525ed
From: Sumit Bose <sbose@redhat.com>
Date: Mon, 9 Feb 2026 14:10:29 +0100
Subject: [PATCH] sdap: do not require GID for non-POSIX group
diff -up sssd-2.12.0/src/providers/ldap/sdap_async_groups.c.orig sssd-2.12.0/src/providers/ldap/sdap_async_groups.c
--- sssd-2.12.0/src/providers/ldap/sdap_async_groups.c.orig 2026-01-14 15:59:45.560996918 +0100
+++ sssd-2.12.0/src/providers/ldap/sdap_async_groups.c 2026-04-02 10:34:30.367027491 +0200
@@ -620,15 +620,17 @@ static int sdap_save_group(TALLOC_CTX *m
goto done;
}
- ret = sysdb_attrs_get_uint32_t(attrs,
- opts->group_map[SDAP_AT_GROUP_GID].sys_name,
- &gid);
- if (ret != EOK) {
- DEBUG(SSSDBG_CRIT_FAILURE,
- "no gid provided for [%s] in domain [%s].\n",
- group_name, dom->name);
- ret = EINVAL;
- goto done;
+ if (posix_group) {
+ ret = sysdb_attrs_get_uint32_t(attrs,
+ opts->group_map[SDAP_AT_GROUP_GID].sys_name,
+ &gid);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "no gid provided for [%s] in domain [%s].\n",
+ group_name, dom->name);
+ ret = EINVAL;
+ goto done;
+ }
}
}
}
diff -up sssd-2.12.0/src/tests/tests/system/tests/test_identity.py.orig sssd-2.12.0/src/tests/tests/system/tests/test_identity.py
--- sssd-2.12.0/src/tests/tests/system/tests/test_identity.py.orig 2026-01-14 15:59:45.611996896 +0100
+++ sssd-2.12.0/src/tests/tests/system/tests/test_identity.py 2026-04-02 10:34:30.368219151 +0200
@@ -761,3 +761,40 @@ def test_identity__filter_groups_by_name
result = client.tools.getent.group(20001)
assert result is None, "Filtered group was found"
+
+
+@pytest.mark.importance("critical")
+@pytest.mark.topology(KnownTopologyGroup.AnyAD)
+def test_identity__nested_non_posix_group(client: Client, provider: GenericADProvider):
+ """
+ :title: Lookup indirect group-members of a nested non-POSIX group
+ :setup:
+ 1. Add a new POSIX user and two new groups, one POSIX the other non-POSIX
+ 2. Add the user to the non-POSIX group and the non-POSIX group to the POSIX group
+ 3. Set 'ldap_id_mapping = false' to allow non-POSIX groups, because
+ with POSIX id-mapping enabled all groups will get POSIX ID and hence
+ there are no non-POSIX groups, and start SSSD
+ :steps:
+ 1. Lookup the POSIX group with getent
+ :expectedresults:
+ 1. Group is present and the new user is a member
+ :customerscenario: False
+ """
+ user = provider.user("nesteduser").add(
+ uid=10001, gid=20001, password="Secret123", gecos="User for tests", shell="/bin/bash"
+ )
+ nested_group = provider.group("nested_nonposix_group").add().add_member(user)
+ base_group = provider.group("posix_group").add(gid=30001).add_member(nested_group)
+
+ client.sssd.domain["ldap_id_mapping"] = "false"
+ client.sssd.start()
+
+ result = client.tools.getent.group(base_group.name)
+ assert result is not None, f"Group '{base_group.name}' not found!"
+ assert (
+ len(result.members) == 1
+ ), f"Group '{base_group.name}' has unexpected number of members [{len(result.members)}]!"
+ assert f"{user.name}" in result.members, f"Member '{user.name}' of group '{base_group.name}' not found!"
+
+ result = client.tools.getent.group(nested_group.name)
+ assert result is None, f"Non-POSIX Group '{nested_group.name}' was found with 'getent group'!"

6
sssd.spec
View File

@ -21,7 +21,7 @@
Name: sssd
Version: 2.12.0
Release: 1%{?dist}
Release: 2%{?dist}
Summary: System Security Services Daemon
License: GPL-3.0-or-later
URL: https://github.com/SSSD/sssd/
@ -29,6 +29,7 @@ Source0: https://github.com/SSSD/sssd/releases/download/2.12.0/sssd-2.12.0.tar.g
Source1: sssd.sysusers
### Patches ###
Patch1: 0001-do-not-require-GID-for-non-POSIX-group.patch
### Dependencies ###
@ -1087,6 +1088,9 @@ fi
%systemd_postun_with_restart sssd.service
%changelog
* Thu Apr 2 2026 Tomas Halman <thalman@redhat.com> - 2.12.0-2
- Resolves: RHEL-148232 - Failed to resolve indirect group-members of nested non-POSIX group
* Thu Jan 15 2026 Sumit Bose <sbose@redhat.com> - 2.12.0-1
- Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2
- Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000]