SSSD / sssd

#3170 PAC: Process domain-local groups from another domain
Closed: wontfix by pbrezina. Opened by jhrozek.

Closed: wontfix
Reopen Issue

Setup is like this:
- a user is from a domain win.trust.test (sid=S-1-5-21-2289655088-1065411832-3487428825)
- in that domain, he is a member of a global group (rid=1107) which is a member of a universal group (rid=1108). This is how the groups are displayed:

groups: struct samr_RidWithAttributeArray
    count                    : 0x00000003 (3)
    rids                     : *
        rids: ARRAY(3)
            rids: struct samr_RidWithAttribute
                rid                      : 0x00000201 (513)
                attributes               : 0x00000007 (7)
                        1: SE_GROUP_MANDATORY       
                        1: SE_GROUP_ENABLED_BY_DEFAULT
                        1: SE_GROUP_ENABLED         
                        0: SE_GROUP_OWNER           
                        0: SE_GROUP_USE_FOR_DENY_ONLY
                        0: SE_GROUP_RESOURCE        
                    0x00: SE_GROUP_LOGON_ID         (0)
            rids: struct samr_RidWithAttribute
                rid                      : 0x00000453 (1107)
                attributes               : 0x00000007 (7)
                        1: SE_GROUP_MANDATORY       
                        1: SE_GROUP_ENABLED_BY_DEFAULT
                        1: SE_GROUP_ENABLED         
                        0: SE_GROUP_OWNER           
                        0: SE_GROUP_USE_FOR_DENY_ONLY
                        0: SE_GROUP_RESOURCE        
                    0x00: SE_GROUP_LOGON_ID         (0)
            rids: struct samr_RidWithAttribute
                rid                      : 0x00000454 (1108)
                attributes               : 0x00000007 (7)
                        1: SE_GROUP_MANDATORY       
                        1: SE_GROUP_ENABLED_BY_DEFAULT
                        1: SE_GROUP_ENABLED         
                        0: SE_GROUP_OWNER           
                        0: SE_GROUP_USE_FOR_DENY_ONLY
                        0: SE_GROUP_RESOURCE        
                    0x00: SE_GROUP_LOGON_ID         (0)
- in child domain, there is a domain-local group. This group shows up in PAC in another part of the PAC, net ads pac dump says:
res_group_dom_sid        : *
    res_group_dom_sid        : S-1-5-21-3912068746-500958454-822161554
res_groups: struct samr_RidWithAttributeArray
    count                    : 0x00000001 (1)
    rids                     : *
        rids: ARRAY(1)
            rids: struct samr_RidWithAttribute
                rid                      : 0x00000450 (1104)
                attributes               : 0x20000007 (536870919)
                        1: SE_GROUP_MANDATORY       
                        1: SE_GROUP_ENABLED_BY_DEFAULT
                        1: SE_GROUP_ENABLED         
                        0: SE_GROUP_OWNER           
                        0: SE_GROUP_USE_FOR_DENY_ONLY
                        1: SE_GROUP_RESOURCE

The domain-local group doesn't appear to be processed by the PAC responder.

Should be done together with S4U2Self.

milestone: NEEDS_TRIAGE => SSSD 1.16 beta

Fields changed

rhbz: => todo

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD Future releases (no date set yet)

Metadata Update from @thalman:
- Custom field design_review reset (from 0)
- Custom field mark reset (from 0)
- Custom field patch reset (from 0)
- Custom field review reset (from 0)
- Custom field sensitive reset (from 0)
- Custom field testsupdated reset (from 0)
- Issue close_status updated to: None
- Issue tagged with: Canditate to close

Thank you for taking time to submit this request for SSSD. Unfortunately this issue was not given priority and the team lacks the capacity to work on it at this time.

Given that we are unable to fulfill this request I am closing the issue as wontfix.

If the issue still persist on recent SSSD you can request re-consideration of this decision by reopening this issue. Please provide additional technical details about its importance to you.

Thank you for understanding.

Metadata Update from @pbrezina:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4203

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None

Candidate to close

None
None
Normal
defect
SSSD
1.14.1
false
false
false
todo
false
false
false
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.