Problem:
When trying to telnet into a Unix machine with your Active Directory credentials, you see the error "id: cannot find name for group ID XX", where XX is a number less than 100.
Cause:
This can occur if you created a group in Active Directory and enabled it for a zone with the GID set to less than 100.
By default, DirectControl is configured to ignore all GIDs under 100 and not perform a lookup of the Unix name from Active Directory.
This reduces network traffic and the load placed on Active Directory.
Resolution:
You can do one of the following:
- Change the GID for the group to a number higher than 100.
- Change DirectControl's default setting for starting GIDs (instructions below).
To change DirectControl's default setting for starting GIDs:
(1) On the Unix machine, open the file /etc/centrifydc/centrifydc.conf.
(2) Search for "nss.mingid" and edit the following setting by changing "XX" to the minimum GID you want DirectControl to look up through Active Directory: nss.mingid XX-n
(3) Restart the DirectControl daemon (adclient) using this command: /etc/init.d/centrifydc restart