SSSD не может перечислить вторичные группы Active Directory, «Нет записей tokenGroups для [пользователя]»

Я пытался настроить интеграцию Active Directory на моем хосте ubuntu 16.04 с помощью Realmd / SSSD (SSSD версии 1.13.4). Я могу войти в систему как пользователь AD, и перечисление групп работает с помощью команды getent group, однако установка неправильно перечисляет членство пользователей в группах с помощью команды id user@my.domain.

Я прикреплю свои файлы конфигурации и соответствующие файлы журнала для SSSD (уровень отладки установлен на 9). Насколько я могу судить по синтаксическому анализу файлов журнала, похоже, что SSSD не может запросить tokenGroups для пользователя, утверждая, что запрос не возвращает группы токенов.

Я проверил, что tokenGroups можно получить с сервера Windows Active Directory, написав некоторый базовый код .Net, который запрашивает атрибут tokenGroups и правильно возвращает все группы. Однако похоже, что SSSD по той или иной причине сталкивается с проблемой. Я считаю, что моя Active Directory использует схему rfc2307bis, и я пробовал включать и выключать этот параметр, как с ldap_group_member = member / uniqueMember, но это ничего не изменило (более того, я не думаю, что это влияет на поиск группы если SSSD пытается использовать tokenGroups).

SSSD.conf:

[sssd]
domains = my.domain
config_file_version = 2
services = nss, pam
debug_level = 9

[nss]
debug_level = 9

[pam]
debug_level = 9

[domain/mydomain]
ad_domain = ad.utah.edu
krb5_realm = AD.UTAH.EDU
#Specifying the site is essential to avoid talking to firewalled DC servers
dns_discovery_domain = CAMPUS._sites.my.domain
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_sasl_authid = AD-INTEGRATION-$
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = simple
simple_allow_users = user1, user2, user3
simple_allow_groups = $
debug_level = 9

Файл журнала активного каталога SSSD:

(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_send] (0x4000): Retrieving info for initgroups call
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [DC=myDC=domain]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_print_server] (0x2000): Searching IP.IP.IP.IP
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=<myuserid>)(objectclass=user)(objectSID=*))][DC=myDC=domain].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixUserPassword]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixHomeDirectory]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPrincipalName]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [name]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectGUID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [primaryGroupID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [whenChanged]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 14
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_op_add] (0x2000): New operation 14 timeout 6
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d21d50], connected[1], ops[0x1d3c540], ldap[0x1d55a80]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=<myuserid>,OU=People,DC=myDC=domain].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [name]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectGUID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [primaryGroupID]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectSid]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [sAMAccountName]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_range] (0x2000): No sub-attributes for [userPrincipalName]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d21d50], connected[1], ops[0x1d3c540], ldap[0x1d55a80]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_op_destructor] (0x2000): Operation 14 finished
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_user] (0x4000): Receiving info for the user
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [ldb] (0x4000): start ldb transaction (nesting: 0)
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_user] (0x4000): Storing the user
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Save user
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_primary_name] (0x0400): Processing object <myuserid>
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Processing user <myuserid>
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x1000): Mapping user [<myuserid>] objectSID [S-1-5-21-1599696121-1964574698-334091239-36222] to unix ID
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x2000): Adding originalDN [CN=<myuserid>,OU=People,DC=myDC=domain] to attributes of [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Original memberOf is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): original mod-Timestamp is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Original USN value is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Adding user principal [<myuserid>@my.domain] to attributes of [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowLastChange is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowMin is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowMax is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowWarning is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowInactive is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowExpire is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): shadowFlag is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): krbLastPwdChange is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): krbPasswordExpiration is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): pwdAttribute is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): authorizedService is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): adAccountExpires is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): adUserAccountControl is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): nsAccountLock is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): authorizedHost is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): ndsLoginDisabled is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): ndsLoginExpirationTime is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): ndsLoginAllowedTimeMap is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): sshPublicKey is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): authType is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_attrs_add_ldap_attr] (0x2000): userCertificate is not available for [<myuserid>].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sysdb_attrs_get_aliases] (0x2000): Domain is case-insensitive; will add lowercased aliases
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_save_user] (0x0400): Storing info for user <myuserid>
...
...
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_initgr_user] (0x4000): Process user's groups
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_print_server] (0x2000): Searching IP.IP.IP.IP
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [no filter][CN=<myuserid>,OU=People,DC=myDC=domain].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [tokenGroups]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 13
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_op_add] (0x2000): New operation 13 timeout 6
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d21d50], connected[1], ops[(nil)], ldap[0x1d55a80]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d22e00], connected[1], ops[0x1dcd720], ldap[0x1d23110]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=<myuserid>,OU=People,DC=myDC=domain].
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_parse_entry] (0x1000): Entry has no attributes [0(Success)]!?
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_result] (0x2000): Trace: sh[0x1d22e00], connected[1], ops[0x1dcd720], ldap[0x1d23110]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_op_destructor] (0x2000): Operation 13 finished
(Fri Nov 10 16:49:34 2017) [sssd[be[my.domain]]] [sdap_get_ad_tokengroups_done] (0x1000): No tokenGroups entries for [<myuserid>]

Я также рад предоставить больше журналов. Я также пробовал сделать дамп wirehark, но пакеты LDAP зашифрованы с помощью SASL, и мне не удалось передать KRB5 keytab в wirehark для его расшифровки (возможно, файл keytab зашифрован? Или, возможно, wirehark нужен файл server keytab «Мне было трудно расшифровать документацию wirehark по этому вопросу).