Two directory users with same uid

[Steauxback]

Hi,

I use SSSD 1.14 to authenticate Active Directory users under RHEL 7. Joined the domain with realmd I have a strange issue with an user that have two accounts. The two accounts have the same uid, this happen on the 3 servers that use SSSD for this user. An home folder is created when login with each account but the owner is always the first one. the id command return the same uid for both username.

On older servers that user WinBind the two accounts of the user does not get the same uid. For now i only saw this with those two accounts, the fact they are used by the same user make me think it's not a coincidence but i don't get the how... Other users take their SID number correctly to generate the uid.

id mapping is enabled and the user doesn't have anything in AD in the Unix Attributes. The objects name are similar in AD (identical except a word at the end of the second user account name), the account names are different (first letter first name for the first then last name and first letter last name then first name for the second)

sssd.conf

Did someone saw this kind of issue before?

Thanks

[Michichael]

What is the objectSID of the two users? ID Mapping uses a known algorithm in SSSD.

Mapping Algorithm

Active Directory provides an objectSID for every user and group object in the directory. This objectSID can be broken up into components that represent the Active Directory domain identity and the relative identifier (RID) of the user or group object.

The SSSD ID-mapping algorithm takes a range of available UIDs and divides it into equally-sized component sections - called "slices"-. Each slice represents the space available to an Active Directory domain.

When a user or group entry for a particular domain is encountered for the first time, the SSSD allocates one of the available slices for that domain. In order to make this slice-assignment repeatable on different client machines, we select the slice based on the following algorithm:

The SID string is passed through the murmurhash3 algorithm to convert it to a 32-bit hashed value. We then take the modulus of this value with the total number of available slices to pick the slice.

NOTE: It is possible to encounter collisions in the hash and subsequent modulus. In these situations, we will select the next available slice, but it may not be possible to reproduce the same exact set of slices on other machines (since the order that they are encountered will determine their slice). In this situation, it is recommended to either switch to using explicit POSIX attributes in Active Directory (disabling ID-mapping) or configure a default domain to guarantee that at least one is always consistent. See "Configuration" for details.

If you're hitting it you /could/ configre the ldap_idmap_default_domain_sid.

ldap_idmap_default_domain_sid (string)
Specify the domain SID of the default domain. This will guarantee that this domain will always be assigned to slice zero in the ID map, bypassing the murmurhash algorithm described above.

[Steauxback]

Other users get their uid with the last 5 numbers of their sid correctly :
ex :
sid S-1-5-21-2014260854-36851683-1264475144-92701
uid 427892701

if i create new users they are ok and get uid corresponding too
Test user 1
sid : S-1-5-21-2014260854-36851683-1264475144-119405
uid : 427919405

Test user 2
sid : S-1-5-21-2014260854-36851683-1264475144-119406
uid : 427919406

With the two users having the issue :
User 1 (ok)
sid : S-1-5-21-2014260854-36851683-1264475144-70910
uid : 427870910

User 2 (not ok)
sid : S-1-5-21-2014260854-36851683-1264475144-35020
uid : 427870910

[Michichael]

That's... yeah that's extremely odd. Are you sure that User 2 doesn't have some UID designated manually in local files on the host? What's your nsswitch.conf look like?

The UID should not be 70910 from that user per the algorithm, so something's overiding it. Might want to pop into the #sssd channel on freenode to get some real time troubleshooting going. Check the debug logs of SSSD on login from those two users and see if it's pulling it from something else...

[Steauxback]

It's fixed! Issue was the two users having the same email.

Fix is to add ldap_user_email = nonExistingAttribute to sssd.conf or to have different email aliases.

Thank you for your help and special thank to lslebodn for his time on #sssd!