• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar

The Geek Diary

CONCEPTS | BASICS | HOWTO

  • OS
    • Linux
    • CentOS/RHEL
    • Solaris
    • Oracle Linux
    • Linux Services
    • VCS
  • Database
    • oracle
    • oracle 12c
    • ASM
    • mysql
    • MariaDB
    • Data Guard
  • DevOps
    • Docker
    • Shell Scripting
  • Interview Questions
  • Big Data
    • Hadoop
    • Cloudera
    • Hortonworks HDP

CentOS/RHEL: “id” command doesn’t list the Group Name against GID for LDAP Users

By admin

The Problem

While running “id” command against LDAP users, it only displays the gid for some secondary group and the group name is not being printed:

# id user1
uid=48254(user1) gid=100(users) groups=100(users),5002(group1),5001(group2),41257(group3),856(group4),56971

And, the below error was logged in /var/log/sssd/sssd_nss.log :

(Tue Mar 14 05:40:09 2020) [sssd[nss]] [nss_cmd_getgrgid_search] (0x0010): getgrgid call returned more than one result !?!

The Solution

The new group was added with same GID as the one of the existing one.

# id user1
uid=48254(user1) gid=100(users) groups=100(users),5002(group1),5001(group2),41257(group3),856(group4),56971(group6)

# getent group group5
group5:*:56971:

# id user1
uid=48254(user1) gid=100(users) groups=100(users),5002(group1),5001(group2),41257(group3),856(group4)

The same ID is mapped to 2 groups, group5 and group6. So when we do id once we get a correct result for the user (all the users groups are shown). Then we run getent group for the other group:

# getent group group5

But after that, it seems the group is dropped from the id results.

SSSD has a hard restriction in the SysDB that only one group can exist with a particular ID. When a group is renamed on the server, it becomes an order-of-operations issue whether or not we handle it correctly. We don’t support multiple entries with the same GID and that doing so will result in unexpected behavior.

So the below error was logged in /var/log/sssd/sssd_nss.log :

(Tue Mar 14 05:40:09 2020) [sssd[nss]] [nss_cmd_getgrgid_search] (0x0010): getgrgid call returned more than one result !?!

Thus, once you correct the entry in LDAP server, the sssd should be able to pick it up again correctly. If it doesn’t then wait for 300 secs as the default time for that cache to flush itself is 300 seconds (i.e. five minutes). Also you can use below command to flush sssd cache with suitable options as per the requirement:

The -E flag can be used to invalidate all cached entries. Exception is sudo rules.

# sss_cache -E

You can also invalidate a specific user only from the cache with the -u flag, followed by the username.

# sss_cache -u user1

Also, you can delete the sss_cache file from within the /var/lib/sss/db/ directory.

# service sssd stop
# rm -rf /var/lib/sss/db/*
# service sssd start

Filed Under: CentOS/RHEL, CentOS/RHEL 6, CentOS/RHEL 7

Some more articles you might also be interested in …

  1. “iscsiadm” Discovery TimeOut With Two Or More Network Interfaces in CentOS/RHEL
  2. Audit rules to log reboot command executions in CentOS/RHEL
  3. Audit Log And Messages File Not Rotating on CentOS/RHEL
  4. CentOS / RHEL : How to log all LVM commands
  5. How to configure the logging of failed login attempts for vsftpd
  6. “Failed to Start Activation of LVM2 Logical Volumes” and “Unit lvm2-activation-net.service Entered Failed State” – CentOS/RHEL 7 booting issue
  7. Command ‘df -i’ Shows ‘Inode=0’ on BTRFS File System
  8. How to enable core dump for Applications on CentOS/RHEL
  9. How to make ethtool settings persistent across reboots in CentOS / RHEL 6,7
  10. ‘lxc_cgfs – Device or resource busy – failed to set memory.use_hierarchy to 1; continuing’ – error while starting LXC container

You May Also Like

Primary Sidebar

Recent Posts

  • SQL script to find tables that are fragmented
  • TRUNCATE TABLE not releasing space from tablespace
  • How to reclaim entire space of an oracle database table with “Truncate Table” statement
  • Oracle SQL Script to Report Tablespace Free and Fragmentation
  • Archives
  • Contact Us
  • Copyright

© 2021 · The Geek Diary