Groups
POSIX, non-POSIX and External groups, how an External group brings an AD group into Linux policy, nesting and indirect members, and what netgroups are for.
Identity › Groups has three pages: user groups, host groups, netgroups. Host groups are covered under Hosts; this page is about user groups and netgroups.
Three kinds of user group
| Kind | GID | Does | Used for |
|---|---|---|---|
| POSIX | yes | shows in id output; the filesystem can use it as group owner | default. Shared directories, chgrp |
| non-POSIX | none (blank in the list) | member container only; invisible to id on clients | purely for HBAC / sudo / roles |
| External | none | members are AD users or groups (SIDs); cannot hold IPA users | mapping an AD group in, see below |
Pick "non-POSIX" at creation to save a GID; a POSIX group cannot be converted back.
Installer groups: admins (domain administrators), editors, ipausers (every active user is in it; the default group is set on the Configuration page), trust admins (may create trusts).
External groups: AD groups managing Linux access
Needs the ad-trust module and an established trust (AD trust prerequisites).
HBAC and sudo rules only accept IPA groups, never AD groups. The bridge is two groups:
- An External group (e.g.
ad_linux_admins); under Members › External add the AD groupAD.EXAMPLE.COM\linux-admins. IPA resolves the SID against AD at that moment; if AD is unreachable the add fails. - A POSIX group (e.g.
ad-admins) with the External group as a member group. - HBAC / sudo rules reference the POSIX group.
Why two: an External group has no GID, so clients cannot treat it as a POSIX group; a POSIX group cannot hold AD objects directly. Membership changes happen in AD; nothing on the IPA side moves.
Members and nesting
The Members tab has five kinds: users, user groups, services, external, user ID overrides, with a Direct / Indirect switch at the top right. Indirect members come from nesting: if A contains B, B's members are indirect members of A and count for HBAC / sudo. Nesting has no depth limit, but sssd expands it on every login; beyond three or four levels logins slow down noticeably.
"Member managers" are users or groups allowed to edit this group's membership without being in admins; for department leads managing their own group.
Netgroups
A netgroup (NIS netgroup) is a set of user × host × domain triples for software that still reads netgroup: NFS exports, older sudoers, /etc/security/access.conf. New deployments should use HBAC; create a netgroup only when a client program explicitly needs one. IPA auto-generates a hidden netgroup for every host group; ipa netgroup-find --private lists them.
Boundaries
- Group names cannot be changed after creation in the UI (
ipa group-mod --renamecan). - Deleting a group does not delete its members; rules that referenced it simply lose that entry and do not fail.
- External members display as the AD group's SID or the resolved name; once the trust is down the name cannot be resolved and the SID shows again.
Services
How service principals are named, when one is needed, how certificates and keytabs reach it, and what the PAC type and pre-authentication options mean.
ID views
When an ID view is the right tool, which attributes an override can change, how a view is applied to hosts, and why Default Trust View must not be deleted.