PAMSC sewhoami command is not listing the OS group for some users

Products

• CA Privileged Access Manager - Server Control (PAMSC)
• CA Privileged Identity Management Endpoint (PIM)
• CA Virtual Privilege Manager

Issue/Introduction

When running sewhoami -a for users within an OS group, some do not show the group properly. This is causing rules to be applied inconsistently between members of the group.

For example, the OS group testgroup is shown in the output of id for exampleuser. When sewhoami -a is called, it shows the group as well.

# id
uid=###1(exampleuser) gid=10101(testgroup) groups=10101(testgroup) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
# sewhoami -a
exampleuser
ACEE Contents
  User's Name             : exampleuser
  ACEE's Handle           : 79
  Group Connections Table:
    Group Name              Connection Mode
            ====================    =================================
    testgroup                 OS_group 
Categories              : <None>
Profile Group           : <None>
Security Label          : <None>
User's Audit Mode       : Failure LoginSuccess LoginFailure 
User's Security Level   : 0
Source Terminal         : localhost
Process Count for ACEE  : 1
User's Mode             : OS_user 
ACEE's Creation Time    : Tue Jun  7 17:36:55 2022

For exampleuser2, id shows the group but sewhoami -a shows the group list as <Empty>.

# id
uid=###2(exampleuser2) gid=10101(testgroup) groups=10101(testgroup) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
# sewhoami -a
exampleuser2
ACEE Contents
  User's Name             : exampleuser2
  ACEE's Handle           : 79
  Group Connections Table:
<Empty>
Categories              : <None>
Profile Group           : <None>
Security Label          : <None>
User's Audit Mode       : Failure LoginSuccess LoginFailure 
User's Security Level   : 0
Source Terminal         : localhost
Process Count for ACEE  : 1
User's Mode             : Regular 
ACEE's Creation Time    : Wed Jun 15 17:55:36 2022

Cause

The issue is occurring because testgroup is an XGROUP and exampleuser is an XUSER, but exampleuser2 is a USER. A USER cannot be a member of an XGROUP within PAMSC, they can only be a member of a GROUP. 

# selang -s -c "sxg testgroup"
(localhost)
Data for XGROUP 'testgroup'
 -----------------------------------------------------------
Owner             : nobody        (USER   )
Create time       : 15-Jun-2022 12:32
Update time       : 15-Jun-2022 12:32
Updated by        : root          (USER   )

# selang -s -c "sxu exampleuser"
(localhost)
Data for XUSER 'exampleuser'
 -----------------------------------------------------------
Owner             : root          (USER   ) 
Last accessed     : localhost
Last access time  : 17-Jun-2022 16:06
Create time       : 07-Jun-2022 17:27
Update time       : 07-Jun-2022 17:27
Updated by        : root          (USER   )

# selang -s -c "su exampleuser2"
(localhost)
Data for USER 'exampleuser2'
 -----------------------------------------------------------
Audit mode        : Login-Success, Failure, Login-Failure
Owner             : nobody        (USER   )
Last accessed     : localhost
Last access time  : 15-Jun-2022 17:55
Create time       : 15-Jun-2022 17:55
Update time       : 15-Jun-2022 17:55
Updated by        : root          (USER   )

Resolution

To have the groups shown for both users, perform one of the following options.

1. Remove exampleuser2, then create an xuser for it.
   > ru exampleuser2
   > exu exampleuser2
2. Remove exampleuser and tesrgroup, then create a user and group resource for them.
   > rxu exampleuser
   > rxg testgroup
   > eu exampleuser
   > eg testgroup