SSSD / sssd

#2211 no primary group ID provided for [user] in domain
Closed: Fixed Opened by andrewmc.

Closed: Fixed
Reopen Issue

Hello -

I'm testing an LDAP login to AD to determine its feasibility for our group. I've installed CentOS6 in a VM on my machine, and have been using sssd (1.9.2) for testing.

Our AD does not have the Unix extensions installed, and thus I'm attempting to get it working with the "ldap_id_mapping" feature of SSSD. I've currently got the UID portion working, by increasing the idmap ranges (config below).

However, at this time, the sdap_save_user is failing with "no primary group ID provided". I've read many previous bug/ticket reports about how the UID and GID are calculated, and I can't seem to figure out why the Group ID is not able to be determined from the objectSID data that we have.

(Thu Jan 23 19:06:16 2014) [sssd[be[default]]] [sdap_idmap_add_domain] (0x0100): Adding domain [S-1-5-21-1538607324-3213881460-940295383] as slice [0]

(Thu Jan 23 19:06:16 2014) [sssd[be[default]]] [sysdb_idmap_store_mapping] (0x0100): Adding new ID mapping [S-1-5-21-1538607324-3213881460-940295383][S-1-5-21-1538607324-3213881460-940295383][0]

(Thu Jan 23 19:06:16 2014) [sssd[be[default]]] [sdap_save_user] (0x0080): no primary group ID provided for [eandmcq] in domain [default].

(Thu Jan 23 19:06:16 2014) [sssd[be[default]]] [sdap_save_user] (0x0040): Failed to save user [eandmcq]

I need to understand if the above objectSID contents are expected to map to an appropriate GID.

This ticket can be closed. I switched the "ldap_schema" to "ad" and this seems to have resolved the problem with being able to obtain the GID from the objectSID.

I'm glad it works now!

resolution: => fixed
status: new => closed

Fields changed

rhbz: => 0

Metadata Update from @andrewmc:
- Issue set to the milestone: SSSD AD Trust Feature

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3253

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
Normal
defect
SSSD
1.9.2
sdap_save_user objectSID primary group
0
0
0
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.