SSSD / sssd

#3734 AD idmap does not display builtin groups
Closed: wontfix by pbrezina. Opened by firstyear.

Closed: wontfix
Reopen Issue

When using ldap+ad schema, builtin groups are not displayed in the list of memberships.

Older versions of sssd will inconsistently display and remove these (freebsd for example).

This can be seen in logs:

(Wed May  9 14:10:59 2018) [sssd[be[blackhats.net.au]]] [sdap_ad_tokengroups_initgr_mapping_done] (0x1000): Processing membership SID [S-1-5-32-549]
(Wed May  9 14:10:59 2018) [sssd[be[blackhats.net.au]]] [sdap_idmap_sid_to_unix] (0x0400): Object SID [S-1-5-32-549] is a built-in one.
(Wed May  9 14:10:59 2018) [sssd[be[blackhats.net.au]]] [sdap_ad_tokengroups_initgr_mapping_done] (0x0400): Skipping built-in object.

Rather than blanket skipping builtins, it could be a configurable choice to allow builtins to be idmapped. This may make sense in single domain configurations, but may not be relevant in forest or trust topologies.

At the least, it could be good to advertise this elimination of builtins in the man page.

Thank you for filing the bug.

I was wondering if you are interested in submitting a patch for this?

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD Patches welcome

Thank you for taking time to submit this request for SSSD. Unfortunately this issue was not given priority and the team lacks the capacity to work on it at this time.

Given that we are unable to fulfill this request I am closing the issue as wontfix.

If the issue still persist on recent SSSD you can request re-consideration of this decision by reopening this issue. Please provide additional technical details about its importance to you.

Thank you for understanding.

Metadata Update from @pbrezina:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4742

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
High
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.