Login fails if user is in entra group which already exists on the system

[adombeck]

If I add a user to an entra group named "sudo" (or any other name that of a group in /etc/group), then logging in as that user fails. The log shows:

can't check authentication: failed to update user "[email protected]": group "sudo" already exists on the system (but not in this authd instance)

I think we should not lock the user out in that case. It should be fine to let the user log in without creating the group.

[adombeck]

I think we should not lock the user out in that case. It should be fine to let the user log in without creating the group.

@3v1n0 @denisonbarbosa any objections?

[denisonbarbosa]

I wonder whether this could result in unwanted behavior though. If we opt to switch to the merge strategy of the NSS modules (i.e. it merges all the users that belong to a single group defined in multiple modules), which we did talk about during the sprint IIRC, then this could result in a surprising behavior from an admin POV, no?

I think it should be fine if we document it properly, but it's food for thoughts nevertheless.

[adombeck]

I wonder whether this could result in unwanted behavior though. If we opt to switch to the merge strategy of the NSS modules (i.e. it merges all the users that belong to a single group defined in multiple modules), which we did talk about during the sprint IIRC, then this could result in a surprising behavior from an admin POV, no?

I don't understand, can you elaborate?