Project

General

Profile

Bug #10995

idmap fails to lookup group SID in AD

Added by Gordon Ross 5 months ago. Updated 5 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
-
Start date:
2019-05-14
Due date:
% Done:

100%

Estimated time:
Difficulty:
Medium
Tags:
needs-triage

Description

The customer has a complex AD environment, and in this environment there are a few AD groups that idmap fails to resolve to a group ID (GID). It should be able to either find a Unix GID from AD via IDMU (where that exists) or allocate an ephemeral ID (where no Unix GID attribute is present). For most groups that all works fine, but for a few groups idmap fails to map a GID by either method, and that should not happen.

History

#1

Updated by Gordon Ross 5 months ago

  • Description updated (diff)
  • Status changed from New to In Progress
#2

Updated by Gordon Ross 5 months ago

The "problem" SIDs appear to be "SID History" SIDs. the LDAP search that the AD lookup performs only searches the 'objectSid' attribute, not the 'sIDHistory' attribute. The fix modifies the LDAP Filter used in lookup to search both objectSid and sIDHistory.

The reason these lookups fail, rather than resolve to ephemeral IDs, is because 'use_lsa' is set to true. The lsa_lookupsids2 function performs a global search for the specified SID, including in sIDHistory, and so it's able to map the SID to a winname; a check later in the call stack only maps unresolved SIDs to ephemeral IDs if the SID could not be mapped to a winname.

This fix can be tested by creating an AD object with non-NULL sIDHistory attribute (I recommend looking into DSInternals' Add-ADDBSidHistory function: https://github.com/MichaelGrafnetter/DSInternals/releases, which is what I used to reproduce this), then running

idmap show -c -V sid:<SID in sidhistory>

#3

Updated by Gordon Ross 5 months ago

Verified at customer.
Fix in production since mid 2018

#4

Updated by Electric Monk 5 months ago

  • Status changed from In Progress to Closed
  • % Done changed from 0 to 100

git commit a01d29c934f6c146f2cc5bacb5d1d388c27a1257

commit  a01d29c934f6c146f2cc5bacb5d1d388c27a1257
Author: Matt Barden <matt.barden@nexenta.com>
Date:   2019-06-01T16:44:37.000Z

    10995 idmap fails to lookup group SID in AD
    Reviewed by: Gordon Ross <gwr@nexenta.com>
    Approved by: Richard Lowe <richlowe@richlowe.net>

Also available in: Atom PDF