Domain groups not accepted as 'AdminIdentities'

Bug #1991545 reported by James Paton-Smith
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
policykit-1 (Ubuntu)
New
Undecided
Unassigned

Bug Description

Domain groups cannot be configured as 'AdminIdentities' under /etc/polkit-1/localauthority.conf.d

EXAMPLE CONFIG

# /etc/polkit-1/localauthority.conf.d/90-test.conf
[Configuration]
AdminIdentities=unix-group:sysapp

With the above config, 'sysapp' is a group in LDAP. SSSD is configured on the machine to allow domain users to log in.
Sudo rules have been configured for the 'sysapp' group and work correctly.

However, any action that creates a polkit/GUI prompt for authentication does not allow users in the 'sysapp' group to authenticate. Instead, it only accepts auth from the root user.

If I change the config to use a local group, instead of a domain group, everything works as expected.
Similarly if I specify a domain USER instead of a domain group, everything works as expected.

The problem seems to only be with domain/LDAP groups.

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: policykit-1 0.105-33
ProcVersionSignature: Ubuntu 5.15.0-48.54-generic 5.15.53
Uname: Linux 5.15.0-48-generic x86_64
ApportVersion: 2.20.11-0ubuntu82.1
Architecture: amd64
CasperMD5CheckResult: unknown
Date: Mon Oct 3 15:20:36 2022
InstallationDate: Installed on 2022-07-15 (80 days ago)
InstallationMedia: Ubuntu 20.04.1 LTS "Focal Fossa" - Release amd64 (20200731)
SourcePackage: policykit-1
UpgradeStatus: Upgraded to jammy on 2022-08-02 (61 days ago)

Revision history for this message
James Paton-Smith (jamesps) wrote :
Revision history for this message
Vegard Søbstad Alsli (alslinet) wrote (last edit ):

This affects 20.04 as well. Can confirm groups do not work and the workarounds for the problems are creative to say the least.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.