Advanced Server Access creates one primary group for each user by default. Using the same group ID value for a user can create attribute conflicts. Enabling the Shared Primary GIDs feature can help provision users with the same group IDs on UNIX environments for better permission management. Currently, the feature is available in Early Access. To enable this feature, please contact Okta Support. 

• Advanced Server Access (ASA)
• Shared Primary GIDs Early Access Feature

Once this feature has been enabled, users can have the same primary group and do not need to worry about the sftd agent reverting the groups. Once the feature is enabled, it will allow the option for the admins to enable or disable the feature on a per-project basis.

Please follow the steps below:

1. Enable the option in the project.

2. If the common group does not exist on the servers, this must be created.

   sudo groupadd <the group name>

3. Once the group is created, find the group ID. 

   grep <the group name> /etc/group
   <the group name>:x:55003:
   

4. Now, the ID of the group 55003 can be used in Advanced Server Access (ASA) to assign the users to the same primary group. This can be done individually in Advanced Server Access (ASA) or in Okta. Mappings can be made to push the attributes to Advanced Server Access (ASA).

1. 1. Advanced Server Access (ASA): Under Project > Users > Edit attributes, add the group ID discovered in step 3, which in the above example is 55003.
   2. In Okta, the user's value needs to be mapped to the UnixGid in Advanced Server Access (ASA).

5. It may take up to 5 minutes for the sync to update the users with the new GID. Once sufficient time has passed, this command can be used to validate the primary GID change. 

   id <the user to be checked>

   ls -l

6. Now that the users have the same primary group, items are shared based on group permissions. 

Related References

• Attribute conflicts