# OIDC+SSSD error on login **URL:** \ **Category:** Get Help\ **Created:** [December 11, 2024, 5:53pm UTC](https://discourse.openondemand.org/t/oidc-sssd-error-on-login/3926 "2024-12-11T17:53:00Z")\ **Posts on this page:** 9\ **Page:** 2

**Author:** ![kstine](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/kstine/32/2539_2.png) [@kstine](https://discourse.openondemand.org/u/kstine)\ **Post date:** [December 16, 2024, 5:39pm UTC](https://discourse.openondemand.org/t/oidc-sssd-error-on-login/3926/21 "2024-12-16T17:39:36Z")

@jeff.ohrstrom Any ideas on how to move forward on this? Or can I just assume that OOD won’t work (in its current stable version) in our environment? ---

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\ **Post date:** [December 16, 2024, 5:47pm UTC](https://discourse.openondemand.org/t/oidc-sssd-error-on-login/3926/22 "2024-12-16T17:47:41Z")

I suspect there’s some sort of SSSD mapping we can do, but can’t really say that’s based off of any facts, just an unfounded suspicion. @tdockendorf do you know of any SSSD configurations that can help us here? ---

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\ **Post date:** [December 16, 2024, 6:08pm UTC](https://discourse.openondemand.org/t/oidc-sssd-error-on-login/3926/23 "2024-12-16T18:08:39Z")

I’m not aware of a way for SSSD to do mapping, it expects the mapping to happen in LDAP or AD. I think SSSD expects AD to have the necessary attributes to do Posix attribute mapping like UID and GID. If those mappings are not present in AD, then I don’t think SSSD has a way to produce those values. If the numbers are consistent you could potentially populate things into `/etc/passwd` and `/etc/group` but if the numbers are random then I can’t think of a solution. ---

**Author:** ![kstine](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/kstine/32/2539_2.png) [@kstine](https://discourse.openondemand.org/u/kstine)\ **Post date:** [December 16, 2024, 6:21pm UTC](https://discourse.openondemand.org/t/oidc-sssd-error-on-login/3926/24 "2024-12-16T18:21:46Z")

@tdockendorf We’re using `ldap_id_mapping` to map SIDs to UIDs and GIDs: [https://linux.die.net/man/5/sssd-ldap](https://linux.die.net/man/5/sssd-ldap) We’re already restricting the OIDC authentication to only allow those in the `cluster-users` group, so if we can just get OOD to ignore the primary group’s lack of a name, it should work, right? ---

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\ **Post date:** [December 16, 2024, 7:42pm UTC](https://discourse.openondemand.org/t/oidc-sssd-error-on-login/3926/25 "2024-12-16T19:42:34Z")

The fact that the primary group is just a number and has no name seems strange, like the SSSD settings are not working correctly or something else is wrong, since the other groups do have a name. I’m not sure if maybe SSSD is having issues with groups using spaces in their name or what. I’ve never used SSSD’s ID mapping in that way so not real sure what should happen with SSSD in terms of what is produces from AD. Based on the Etcd errors it’s like the group ID lookup just isn’t working for that group which makes me think something is not correct with how SSSD is pulling data out of AD. ---

**Author:** ![kstine](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/kstine/32/2539_2.png) [@kstine](https://discourse.openondemand.org/u/kstine)\ **Post date:** [December 16, 2024, 8:22pm UTC](https://discourse.openondemand.org/t/oidc-sssd-error-on-login/3926/26 "2024-12-16T20:22:38Z")

Most likely that’s because we don’t actually populate the `Domain Users` group on our system. Otherwise, we’d have tens of thousands of users that would also need to be mapped. We have it set so that only users that are a part of `cluster-users` get mapped (using `ldap_search_base`). ---

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\ **Post date:** [December 16, 2024, 8:51pm UTC](https://discourse.openondemand.org/t/oidc-sssd-error-on-login/3926/27 "2024-12-16T20:51:35Z")

If that GID 1543400513 is static across systems and also the same primary GID for all users you could populate it into `/etc/group` on the OnDemand host to fake a group entry with that GID. That may be enough to get OnDemand to not throw errors. ---

**Author:** ![kstine](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/kstine/32/2539_2.png) [@kstine](https://discourse.openondemand.org/u/kstine)\ **Post date:** [December 16, 2024, 10:02pm UTC](https://discourse.openondemand.org/t/oidc-sssd-error-on-login/3926/28 "2024-12-16T22:02:26Z")

That did it! Thanks! It logs you in successfully now. It does seem kind of odd though that the group issue blocks login. ---

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\ **Post date:** [June 14, 2025, 10:02pm UTC](https://discourse.openondemand.org/t/oidc-sssd-error-on-login/3926/29 "2025-06-14T22:02:38Z")

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed. [Previous page](https://discourse.openondemand.org/t/oidc-sssd-error-on-login/3926.md?page=1)