hm.... may have been caching. When I removed /var/lib/sss/db/* this problem went away. However at that point "getent -s sss passwd USER" didn't even return data for users in the local file.

may I know what is a use-case for:

id_provider = files
auth_provider = ipa

?

I would like to ask for logs here. But please note that for the AD and IPA providers, there might be assumptions in the code that the user information comes from the same provider.

The 'lower-level' providers such as krb5 or LDAP doesn't have this limitation.

The use case is a server with limited access and its own groups. I want to use local /etc/passwd and group, but Kerberos passwords. There are obviously other ways to achieve my goals, so this isn't a high-priority problem, but it seemed like something that should at least be documented.

The use case is a server with limited access and its own groups. I want to use local /etc/passwd and group, but Kerberos passwords. There are obviously other ways to achieve my goals, so this isn't a high-priority problem, but it seemed like something that should at least be documented.

Then it might better to use id_provider = files with auth_provider = krb5.

I do not think we want to support id_provider = files + auth_provider = ipa

I don't have a problem with saying that it won't work, as long as you document it.

I agree we should turn this ticket into documenting in the sssd-ad and sssd-ipa man pages that the ipa and ad auth providers assume certain properties about user data that the id provider stores in the cache and therefore should only be used with the same provider type.

I didn't want this easy ticket to roll from one release to another, so here's a PR:
https://github.com/SSSD/sssd/pull/479

I wonder if we should also print a DEBUG matches with an incompatible provider type?

master:

• 89ed594e8800fdb288248006e8867a077a57bc6f

sssd-1-14:

• 7a93d0f94855f1574a709b4c930ee99e6e71cb73

sssd-1-13:

• 06dd476f726e484854a85077804720b9a0f6b2da

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4573

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.