[BUG] user.list_groups omits remote groups

[donkopotamus]

Description

In salt-3006, #62378 introduced a change in salt.utils.user.get_group_list to no longer use grp.getgrid and to instead filter grp.grall by group id.

On systems with remote groups provided by sssd for example, where user and group enumeration has been disabled, then the following functions no longer return all of the groups a user is in:

• user.list_groups
• user.info

Only local groups, and no remote groups, will be returned.

This has other serious side effects:

• cmd.run runas=<some-user> will no longer have the complete supplementary group vector.

  Note: In our particular case, this means that processes no longer have the same abililty to access paths protected by ACLs, or remote groups, or may no longer be able to escalate rights via sudo when the rules are group driven.

Note that it is common to disable remote group enumeration in large organisations as it is expensive and causes heavy load. Whenever remote providers do not offer enumeration then grp.grall will not reflect all valid groups on the system. (And from a code perspective, even if it does, it is relatively inefficient to filter grp.grall which may contain tens of thousands of remote groups simply to resolve the 10 or 20 a user may belong to).

Setup

On a machine with sssd enabled, with an ldap provider, and with that provider being configured with enumerate = false.

Steps to Reproduce the behavior

Compare salt-call user.list_groups <user> versus the output of eg groups

Expected behavior

user.list_groups should include remote groups for the user

Versions Report

salt --versions-report

(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)

PASTE HERE

Related: #64888, #64891

[welcome]

Hi there! Welcome to the Salt Community! Thank you for making your first contribution. We have a lengthy process for issues and PRs. Someone from the Core Team will follow up as soon as possible. In the meantime, here’s some information that may help as you continue your Salt journey.
Please be sure to review our Code of Conduct. Also, check out some of our community resources including:

• Community Wiki
• Salt’s Contributor Guide
• Join our Community Slack
• IRC on LiberaChat
• Salt Project YouTube channel
• Salt Project Twitch channel

There are lots of ways to get involved in our community. Every month, there are around a dozen opportunities to meet with other contributors and the Salt Core team and collaborate in real time. The best way to keep track is by subscribing to the Salt Community Events Calendar.
If you have additional questions, email us at [email protected]. We’re glad you’ve joined our community and look forward to doing awesome things with you!

[donkopotamus]

Tagging @nicholasmhughes

[whytewolf]

looking into this and #64888 to try and determine the best coarse of action. right now it is looking like a revert of the code in question. but i want to talk to @nicholasmhughes first. this does not look like it will be in 3006.3.