tl;dr
I want to easily and quickly tell if a user is local or domain (don't care which domain).
Environment
- freeipa-client-4.6.1-3.fc27.x86_64
- sssd-1.16.0-4.fc27.x86_64
Full story
I am writing a userinfo.sh script that will show if a user is local, sssd, can ssh, and is permitted by sssd.
Currently I am doing the check for if the user is from the domain with the getent passwd -s sss $USERNAME command. But I ran into an issue where checking the sssd database returns a local user!
# getent passwd -s sss 'bgstack15-local' bgstack15-local:x:1000:1000:bgstack15-local:/home/bgstack15-local:/bin/bash Checking the contents of the database (cache) for sss shows sssd apparently caches all sorts of information about the local user.
# sudo su root -c 'strings /var/lib/sss/db/* | grep bgstack15-local' | sort | uniq name=bgstack15-local@implicit_files,cn=groups,cn=ih name=bgstack15-local@implicit_files,cn=groups,cn=implicit_files,cn=sysdb name=bgstack15-local@implicit_files,cn=users,cn=implicit_files,cn=sysdb [...output truncated] I tried clearing the sssd cache overall, and just for the user. Neither made a difference.
# sss_cache -U # sss_cache -u bgstack15-local The user does show up as a local user, and I promise it is only a local user!
getent passwd -s files 'bgstack15-local' bgstack15-local:x:1000:1000:bgstack15-local:/home/bgstack15-local:/bin/bash The man pages for getent(1) and getpwent(3) don't help me understand what could be going on. sssd(8) shows me that sssd can cache local users, which actually goes against what I want! The nss section of sssd.conf(5) doesn't help, but maybe I didn't take enough time to read it. I'm a little stuck.
My sssd.conf
[domain/ipa.example.com] id_provider = ipa ipa_server = _srv_, dns1.ipa.example.com ipa_domain = ipa.example.com ipa_hostname = fc27c-01a.ipa.example.com auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True [sssd] services = nss, pam, ssh, sudo domains = ipa.example.com [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] [secrets] [session_recording] Last resort
I can try doing my checks against ${USERNAME}@${DOMAIN} when doing the -s sss check, but that means I then have to iterate over all domains in sssd.conf and that would slow the process down.
