Groups
POSIX, non-POSIX and External groups, how an External group brings an AD group into Linux policy, nesting and indirect members, and what netgroups are for.
This page covers the User groups and Netgroups pages under Identity, Groups. Host groups are covered under Hosts.
Three kinds of user group
| Kind | GID | Effect | Used for |
|---|---|---|---|
| POSIX | Yes | Shows in id output; the filesystem can use it as group owner | Default. Shared directories, chgrp |
| Non-POSIX | None; blank in the list | Member container only; invisible to id on clients | HBAC, sudo and roles only |
| External | None | Members are AD users or groups (SIDs); cannot hold IPA users | Mapping an AD group in; see below |
Choosing non-POSIX at creation saves a GID. A POSIX group cannot be converted back.
Groups created by the installer:
| Group | Purpose |
|---|---|
admins | Domain administrators |
editors | Preset by the installer |
ipausers | Every active user joins it automatically; the default group is set on the Configuration page |
trust admins | May create trusts |
External groups: AD groups managing Linux access
Requires the ad-trust module and an established trust (AD trust prerequisites).
HBAC and sudo rules only accept IPA groups, never AD groups. The bridge is two groups:
- Create an External group (such as
ad_linux_admins). Under Members, External, add the AD groupAD.EXAMPLE.COM\linux-admins. IPA resolves the SID against AD at that moment; if AD is unreachable the add fails. - Create a POSIX group (such as
ad-admins) with the External group as a member group. - Reference the POSIX group in HBAC and sudo rules.
Two groups are needed because an External group has no GID, so clients cannot treat it as a POSIX group, and a POSIX group cannot hold AD objects directly. Membership changes happen in AD; nothing on the IPA side moves.
Members and nesting
The Members tab has five kinds: Users, User groups, Services, External and User ID overrides, with a Direct and Indirect switch at the top right. Indirect members come from nesting: if A contains B, B's members are indirect members of A and count for HBAC and sudo. Nesting has no depth limit, but sssd expands it on every login; beyond three or four levels logins slow down noticeably.
Member managers are users or groups allowed to edit this group's membership without being in admins, for department leads managing their own group.
Netgroups
A netgroup (NIS netgroup) is a set of user, host and domain triples for software that still reads netgroup: NFS exports, older sudoers, /etc/security/access.conf. New deployments use HBAC; a netgroup is created only when a client program explicitly needs one. IPA generates a hidden netgroup for every host group; ipa netgroup-find --private lists them.
Boundaries
| Topic | Notes |
|---|---|
| Renaming a group | Not available in the UI; ipa group-mod --rename can |
| Deleting a group | Members are not deleted. Rules that referenced the group lose that entry and do not fail |
| External member display | Shows the AD group's SID or the resolved name. Once the trust is down the name cannot be resolved and the SID shows again |
Services
How service principals are named, when one is needed, how certificates and keytabs reach it, and what the PAC type and pre-authentication options mean.
ID views
When an ID view is the right tool, which attributes an override can change, how a view is applied to hosts, and why Default Trust View must not be deleted.