22.12. Enabling group merging for local and remote groups in IdM

Procedure

1. Add [SUCCESS=merge] to the /etc/nsswitch.conf file:

   # Allow initgroups to default to the setting for group.
   initgroups: sss [SUCCESS=merge] files

2. Add the idmuser to IdM:

   # ipa user-add idmuser
   First name: idm
   Last name: user
   ---------------------
   Added user "idmuser"
   ---------------------
   User login: idmuser
   First name: idm
   Last name: user
   Full name: idm user
   Display name: idm user
   Initials: tu
   Home directory: /home/idmuser
   GECOS: idm user
   Login shell: /bin/sh
   Principal name: idmuser@IPA.TEST
   Principal alias: idmuser@IPA.TEST
   Email address: idmuser@ipa.test
   UID: 19000024
   GID: 19000024
   Password: False
   Member of groups: ipausers
   Kerberos keys available: False

3. Verify the GID of the local audio group.

   $ getent group audio
   ---------------------
   audio:x:63

4. Add the group audio to IdM:

   $ ipa group-add audio --gid 63
   -------------------
   Added group "audio"
   -------------------
   Group name: audio
   GID: 63

   注意

   The GID you define when adding the audio group to IdM must be the same as the GID of the local audio group.

5. Add idmuser user to the IdM audio group:

   $ ipa group-add-member audio --users=idmuser
   Group name: audio
   GID: 63
   Member users: idmuser
   -------------------------
   Number of members added 1
   -------------------------

Verification

1. Log in as the idmuser.

2. Verify the idmuser has the local group in their session:

   $ id idmuser
   uid=1867800003(idmuser) gid=1867800003(idmuser) groups=1867800003(idmuser),63(audio),10(wheel)