0

I have installed percona PAm plugin on my Percona server as shown below:

mysql> show plugins;
...
| auth_pam                      | ACTIVE   | AUTHENTICATION     | auth_pam.so        | GPL     |
| auth_pam_compat               | ACTIVE   | AUTHENTICATION     | auth_pam_compat.so | GPL     |
+-------------------------------+----------+--------------------+--------------------+---------+

And also have this configured:

cat /etc/pam.d/mysqld 
auth required pam_sss.so
account required pam_sss.so

I have a group on the AD server called "dba", and added an AD user 'john.d' in this group. So i would like to log into MySQL using Ad users e.g., john.d, who should also inherit all privileges granted to the "dba" group. Below is how this AD group, "dba", is a setup to allow its users access the Percona server:

CREATE USER ''@'' IDENTIFIED WITH auth_pam AS 'mysqld,dba=dbarole';
CREATE USER 'dbarole'@'%' IDENTIFIED BY 'dbapass';
GRANT ALL PRIVILEGES ON *.* TO 'dbarole'@'%';
GRANT PROXY ON 'dbarole'@'%' TO ''@'';

When i log in into mysql as dbarole, everything works well with all granted privileges. But when i login as john.d, one of the AD users included into the "dba" AD group, this user does not inherit the privileges (ALL) granted to its group, but only has the USAGE privilege as shown below:

mysql> show grants;
+-----------------------------------+
| Grants for @                      |
+-----------------------------------+
| GRANT USAGE ON *.* TO ''@''       |
| GRANT PROXY ON 'dba'@'%' TO ''@'' |
+-----------------------------------+
2 rows in set (0.00 sec)

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
+--------------------+
1 row in set (0.01 sec)

My Question is, how can i get an AD user inherit privileges granted to their group in MySQL?

  • this blog post may help -percona.com/blog/2017/07/13/… – jerichorivera Dec 24 '18 at 12:16
  • Actually, that is the post i was following, and still could not get things to work as described in my original post. Have you actually been successful in doing so? – The Georgia Dec 26 '18 at 1:36
  • Finally figured out. My solution was to add the AD group to /etc/shadow using the command: realm permit -g dba – The Georgia Dec 27 '18 at 2:07
0

All i had to do is add the dba group using the following realm command:

realm permit -g dba

Doing so will automatically change the /etc/sssd/sssd.conf file and add the following line(s):

access_provider = simple
simple_allow_groups = dba

Before running real, access_provider was setup as "ad", and was automatically changed to "simple" as shoen above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.