-
Título
Authentication Services enabled AD accounts cannot be put in AIX local groups -
Descripción
Authentication Services enabled AD accounts cannot be put in AIX local groups
-
Causa
Product Defect: 28308* LAM: LAM module now uses the same interface as the getgrset. This means groupmemberships through lsuser -a groupsids groups required vasd runningand will no longer integrate local group memberships as per IBM.Product Defect: 434922
* lam: Re-implement the previous behavior removed due to Bug 28308. Now
controlled by a new setting:
[aix_vas]
include-local-group-memberships = true (default is false)
This means QAS will again include local group memberships in its response
for group memberships request. -
Resolución
Authentication Services no longer report users as being members of local groups through its interfaces.The change was due to IBM's documentation as to how our module should work. Therefore, the LAM module and getgrset no longer report users as a member of a local group if /etc/groups is modified with the membership.
RESOLUTION:
This functionality is now included as a configurable option in Authentication Services as of version 4.1.0-21630. This has been logged as Defect number 434922.
To enable the mixing of repositories- QAS users / groups must be merged into the local
/etc/passwdand/etc/groupfiles.
See the vastool man pages for further details.
- "include-local-group-memberships" must be turned on in vas.conf.
[aix_vas]
include-local-group-memberships = true
The following command will set this value as well.
To turn it on.
/opt/quest/bin/vastool configure vas aix_vas include-local-group-memberships true
To turn it off.
/opt/quest/bin/vastool configure vas aix_vas include-local-group-memberships false
The full changelog entry is;
Bug 434922
* lam: Re-implement the previous behavior removed due to Bug 28308. Now
controlled by a new setting:
[aix_vas]
include-local-group-memberships = true (default is false)
This means QAS will again include local group memberships in its response
for group memberships request.
Quest Software does not recommend utilizing mixed repositories in the following situation:
• DB2 9.5 FP4 or DB2 9.7 FP1 is installed on AIX
• Transparent Authentication is enabled
• Active Directory user is UNIX enabled
• Active Directory user is manually placed into a local group
In the situation above the user may be denied access to the database when granting access based on group membership.
For additional information please refer to DCR # MR1204142259 when contacting IBM Support. This references a request to investigate why AD users to local groups does not work in all scenarios.After QAS users have been added to the local groups, QAS users / groups can then be unmerged and the local groups retain their QAS members. See the vastool man pages for further details.
WORKAROUND:
AD users should be put in AD groups and local users should be put into local groups only. They cannot be mixed in the AIX environment.
Suggestion try having two groups, one local, one AD, each the same name and gid. AD users in the AD group, local users in the local group.If multiple systems need the same group name with different membership, one could use an override.And to make management easy, a group policy override with a macro could be made. For example:%HOSTNAME%-oracle:oracle::Where the macro is /bin/hostname | /usr/bin/cut -d. -f1Then in AD there is a matching group named hostname-oracle with the membership needed.One policy, each system gets a unique entry. - QAS users / groups must be merged into the local
-
Solicitud de cambio
28308 -
Información adicional
This change applies to Authentication Services 4.0.3.205 and later.