Os看不到来自LDAP服务器的用户辅助组

Question

因此，once more-os不会看到在ldap中配置的其他组，但在ldap中输入的主组是OK的。

在nsswitch.conf中：

    passwd:     files sss
    shadow:     files sss
    group:      files sss

在sssd.conf中：

    [sssd]
    config_file_version = 2
    services = nss, pam, sudo
    enumerate = true
    domains = LDAP

    [nss]
    filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd
    filter_groups = root,bin,daemon,sys,adm,disk,wheel

    [pam]

    [domain/LDAP]
    #debug_level = 9

    id_provider = ldap
    auth_provider = ldap
    chpass_provider = ldap
    access_provider = ldap
    sudo_provider = ldap

    ldap_schema = rfc2307bis

    ldap_uri = ldap://localhost
    ldap_chpass_uri = ldap://localhost
    ldap_id_uri = ldap://localhost
    ldap_auth_uri = ldap://localhost


    ldap_search_base = dc=domain,dc=com
    ldap_user_search_base = ou=people,dc=domain,dc=com
    ldap_group_search_base = ou=groups,dc=domain,dc=com
    ldap_access_filter = (groupMembership=cn=shell,ou=groups,dc=domain,dc=com)

    enumerate = true
    ldap_enumeration_refresh_timeout=60
    cache_credentials = False
    entry_cache_timeout = 60
    ldap_network_timeout = 3

    id ttest
    uid=10000(ttest) gid=501(shell) группы=501(shell)

    getent group core
    core:*:10000:

    ldapsearch -x -b 'ou=people,dc=domain,dc=com' '(objectclass=*)'
    # extended LDIF
    #
    # LDAPv3
    # base  with scope subtree
    # filter: (objectclass=*)
    # requesting: ALL
    #

    # people, domain.com
    dn: ou=people,dc=domain,dc=com
    ou: people
    objectClass: top
    objectClass: organizationalUnit

    # core, groups, domain.com
    dn: cn=core,ou=groups,dc=domain,dc=com
    objectClass: posixGroup
    gidNumber: 10000
    memberUid: ttest
    cn: core

Answer 1

解决方法很简单。那都是因为我不注意...

我在sssd配置中使用了“RFC2307Bis”架构，而使用“RFC2307”需要它。

这就是为什么在调查中没有列出团体的原因。