[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

[Freeipa-users] HBAC access denied, all AD groups not detected



Hello,

 

We are having a problem with HBAC that appears to be related to group membership lookup.  I am testing with a new install on RHEL 7.2 with a cross-forest trust with AD.  When an AD user attempts to log into a client (RH 6.7 or 7.2) the “hbac_eval_user_element” can report a different number of groups each time and never seems to contain the full list.  For the testing account, running the ‘id’ command returns 153 groups.  The ipa group “ad_admin” has setup to be able to log in anywhere, everyone else is denied.  With the default allow_all rule enabled, everything works as expected.  Any ideas on where I can look next?

 

Example grep from the client domain log (account had no changes to group membership):

(Fri Dec  4 00:46:35 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): [113] groups for [testuser AD DOMAIN COM]

(Fri Dec  4 00:47:31 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): [112] groups for [testuser AD DOMAIN COM]

(Fri Dec  4 01:00:20 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): [72] groups for [testuser AD DOMAIN COM]

(Fri Dec  4 01:10:24 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): [72] groups for [testuser AD DOMAIN COM]

(Fri Dec  4 01:14:20 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): [72] groups for [testuser AD DOMAIN COM]

(Fri Dec  4 01:24:21 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): [72] groups for [testuser AD DOMAIN COM]

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): [73] groups for [testuser AD DOMAIN COM]

 

Example of an HBAC rule passing:

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x2000): Skipping non-group memberOf [CN=]

… repeated for however many groups happened to be examined

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x1000): Added group [ad_admins] for user [testuser AD DOMAIN COM]

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x2469f40

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x2460080

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running timer event 0x2469f40 "ltdb_callback"

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Destroying timer event 0x2460080 "ltdb_timeout"

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending timer event 0x2469f40 "ltdb_callback"

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x245aee0

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x2460080

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running timer event 0x245aee0 "ltdb_callback"

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Destroying timer event 0x2460080 "ltdb_timeout"

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending timer event 0x245aee0 "ltdb_callback"

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x2469f40

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x2460080

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running timer event 0x2469f40 "ltdb_callback"

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Destroying timer event 0x2460080 "ltdb_timeout"

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending timer event 0x2469f40 "ltdb_callback"

(Fri Dec  4 14:27:57 2015) [sssd[be[ipa.domain.com]]] [ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule [admin-access]

 

 

Example of an HBAC rule failing:

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x2000): Skipping non-group memberOf [CN=]

… repeated for however many groups happened to be examined

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [hbac_eval_user_element] (0x2000): Skipping non-group memberOf [CN=]

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x26f8d00

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x26e18d0

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running timer event 0x26f8d00 "ltdb_callback"

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Destroying timer event 0x26e18d0 "ltdb_timeout"

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending timer event 0x26f8d00 "ltdb_callback"

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x27e51f0

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x27f2230

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running timer event 0x27e51f0 "ltdb_callback"

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Destroying timer event 0x27f2230 "ltdb_timeout"

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending timer event 0x27e51f0 "ltdb_callback"

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x2634520

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x27f8a40

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Running timer event 0x2634520 "ltdb_callback"

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Destroying timer event 0x27f8a40 "ltdb_timeout"

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ldb] (0x4000): Ending timer event 0x2634520 "ltdb_callback"

(Thu Dec  3 22:30:10 2015) [sssd[be[ipa.domain.com]]] [ipa_hbac_evaluate_rules] (0x0080): Access denied by HBAC rules

 

Thanks,

   Jeff


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]