sssd-Excluding certain userid ranges from being looked up in directory services

This document (000021178) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 15 All Service Packs
SUSE Linux Enterprise Server 12 All Service Packs
Host using directory services (LDAP/AD) via sssd

Situation

In scenarios of a host, that has several directory services defined, the admin might want to exclude certain ranges from being looked up, because those are known to be unknown and are filling up logfiles for no good purpose. This is especially true for containers running on that host in their own kernel namespaces, because they use arbitrary userids and groupids, that are meaningful within the containers only. If files and directories of such containers are shared with the host, they might trigger unwanted directory lookups (LDAP/AD).

[nss]filter_{users,groups} is available, but requires symbolic names, not numeric values, therefore will not work well for the specific case.

After enabling debug output in /etc/sssd/sssd.conf:

[sssd]
debug_level = 3
...

[nss]
...

[pam]
debug_level = 4
...

[domain/AD]
debug_level = 4

The sssd logs in /var/log/sssd fill up with lines similar to:

==> sssd_nss.log <==
2023-07-26 10:40:47): [nss] [cache_req_common_get_acct_domain_recv] (0x0080): CR #0: Could not get account domain [1432158301]: GetAccountDomain() not supported
(2023-07-26 10:40:47): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/DOM_LOCATE_TYPE/LOCAL/User by ID] to negative cache permanently
(2023-07-26 10:40:47): [nss] [cache_req_locate_dom_done] (0x0100): Disabled domain locating functionality for User by ID
(2023-07-26 10:40:47): [nss] [cache_req_validate_domain_type] (0x2000): Request type POSIX-only for domain LOCAL type POSIX is valid
(2023-07-26 10:40:47): [nss] [cache_req_set_domain] (0x0400): CR #0: Using domain [LOCAL]
(2023-07-26 10:40:47): [nss] [cache_req_search_send] (0x0400): CR #0: Looking up UID:100@LOCAL
(2023-07-26 10:40:47): [nss] [cache_req_search_ncache] (0x0400): CR #0: Checking negative cache for [UID:100@LOCAL]
(2023-07-26 10:40:47): [nss] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/UID/LOCAL/100]
(2023-07-26 10:40:47): [nss] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/UID/100]
(2023-07-26 10:40:47): [nss] [cache_req_search_ncache] (0x0400): CR #0: [UID:100@LOCAL] is not present in negative cache
(2023-07-26 10:40:47): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [UID:100@LOCAL] in cache
(2023-07-26 10:40:47): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [UID:100@LOCAL] was not found in cache
(2023-07-26 10:40:47): [nss] [cache_req_search_dp] (0x0400): CR #0: Looking up [UID:100@LOCAL] in data provider
(2023-07-26 10:40:47): [nss] [sss_domain_get_state] (0x1000): Domain LOCAL is Active
(2023-07-26 10:40:47): [nss] [sss_dp_account_files_params] (0x2000): The entries in the files domain are up-to-date
(2023-07-26 10:40:47): [nss] [sss_domain_get_state] (0x1000): Domain LOCAL is Active
(2023-07-26 10:40:47): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [UID:100@LOCAL] in cache
(2023-07-26 10:40:47): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [UID:100@LOCAL] was not found in cache
(2023-07-26 10:40:47): [nss] [cache_req_search_ncache_add_to_domain] (0x0400): CR #0: Adding [UID:100@LOCAL] to negative cache
(2023-07-26 10:40:47): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/UID/LOCAL/100] to negative cache
(2023-07-26 10:40:47): [nss] [cache_req_validate_domain_type] (0x2000): Request type POSIX-only for domain AD type POSIX is valid
(2023-07-26 10:40:47): [nss] [cache_req_set_domain] (0x0400): CR #0: Using domain [AD]
(2023-07-26 10:40:47): [nss] [cache_req_search_send] (0x0400): CR #0: Looking up UID:100@AD
(2023-07-26 10:40:47): [nss] [cache_req_search_ncache] (0x0400): CR #0: Checking negative cache for [UID:100@AD]
(2023-07-26 10:40:47): [nss] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/UID/AD/100]
(2023-07-26 10:40:47): [nss] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/UID/100]
(2023-07-26 10:40:47): [nss] [cache_req_search_ncache] (0x0400): CR #0: [UID:100@AD] is not present in negative cache
(2023-07-26 10:40:47): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [UID:100@AD] in cache
(2023-07-26 10:40:47): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [UID:100@AD] was not found in cache
(2023-07-26 10:40:47): [nss] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/DOM_LOCATE/NCE/UID/AD/100]
(2023-07-26 10:40:47): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/DOM_LOCATE/NCE/UID/AD/100] to negative cache
(2023-07-26 10:40:47): [nss] [sbus_dispatch] (0x4000): Dispatching.
(2023-07-26 10:40:47): [nss] [sss_dp_get_account_domain_done] (0x0040): Data Provider Error: 3, 1432158301

==> sssd_AD.log <==
(2023-07-26 10:43:24): [be[AD]] [ad_account_can_shortcut] (0x0080): [RID#6] Mapping ID [100] to SID failed: [IDMAP domain not found]
(2023-07-26 10:43:24): [be[AD]] [ad_account_can_shortcut] (0x0080): [RID#7] Mapping ID [100] to SID failed: [IDMAP domain not found]
(2023-07-26 10:43:24): [be[AD]] [ad_account_can_shortcut] (0x0080): [RID#8] Mapping ID [100] to SID failed: [IDMAP domain not found]
(2023-07-26 10:43:49): [be[AD]] [ad_account_can_shortcut] (0x0080): [RID#9] Mapping ID [100] to SID failed: [IDMAP domain not found]

==> sssd_pam.log <==
(2023-07-26 10:42:47): [pam] [sss_parse_name] (0x0100): Domain not provided!
(2023-07-26 10:42:47): [pam] [sss_parse_name] (0x0100): Domain not provided!
(2023-07-26 10:42:47): [pam] [sss_parse_name] (0x0100): Domain not provided!
(2023-07-26 10:42:47): [pam] [sss_parse_name] (0x0100): Domain not provided!

Resolution

The solution to this issue can be achieved by specifying min_id and max_id, and adhering to two rules:

always define both values in a section
define them in a non-overlapping fashion

Here's an excerpt from /etc/sssd/sssd.conf:

[sssd]
domains = LOCAL,AD

[domain/LOCAL]
min_id = 1
max_id = 500

[domain/AD]
min_id = 2001
max_id = 0

Additional Information

Reason for defining both values:

If you specify a min_id for a domain and don't specify a max_id then the range is from min_id to the largest supported id. If you then have another domain that has IDs within that range then they are local IDs by definition.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.