How to override users primary group in Linux?

Question

I have a few Linux servers using SSSD integrated with Microsoft AD to authenticate AD users, and I'm trying override users primary group on those servers.

According to AD, the default primary group for all users is gid=100001(posixusers) and I'd like users to be assigned to a different gid. Each user would have a different primary group, with that being their UID.

So, if user john's UID is 1028 and according to AD his GID is 100001, I want to override the GID, so it would be gid=1028

I believe this can be done by using sss_override, but there are some disadvantages since I'd have to repeat the same command on each Linux server or export/import the override lists and restart sssd.

Also, I don't know how could I automate that when the user login for the first time.

How would you do that? Is there any other way, other than sss_override? If not, what would you do to automate this?

NOTE: I can't touch anything on the AD, since that's managed by a different department, so the only thing I can do is to query the AD/LDAP service.

Thanks in advance.

Answer 1

If you're provisioning access based on AD groups, it is possible to quickly change the primary GID of all users in a group with something like below:

getent group AD-group-name | awk -F':' '{print $4}' | sed 's/\,/\n/g' \
| xargs -i sss_override user-add {} -g $(getent group AD-group-name) \
| awk -F':' '{print $3}')

where AD-group-name is the name of the AD/LDAP group. This should work before a user has logged in if you're using SSSD with AD. Like you said, there are some caveats with sss_override, and this would need to be run again if you're provisioning more users. It's a bit hacky, but you could run this nightly as a cron job or something similar.

You could also run this on several systems using something like ansible. It's on my list to create an ansible playbook that does something like this when we provision a new user.

Answer 2

I don't have enough reputation to reply directly to Gabe's answer, it works great except it should read:

getent group AD-group-name | awk -F':' '{print $4}' | sed 's/\,/\n/g' \  
| xargs -i sss_override user-add {} -g $(getent group AD-group-name \  
| awk -F':' '{print $3}')

Worked great for us as a workaround for the NFS 16 group limit.