On Thu, Nov 19, 2020 at 01:01:41PM -0000, kotelnikova9314--- via FreeIPA-users wrote:
Hi Sumit,
thank you for the comprehensive answer.
Hi,
thanks for the feedback. I guess before running 'ipa-client-install' the
option 'dns_lookup_kdc = True' was not set in krb5.conf. With this
option libkrb5 would use DNS lookups to find suitable AD DCs.
bye,
Sumit
> On Tue, Nov 10, 2020 at 03:56:48PM -0000, kotelnikova9314--- via FreeIPA-users
wrote:
>
> The client will get user and group information from the FreeIPA server
> but for authentication (Kerberos) they will talk with AD DCs directly.
Ok, i see, thank you for the explanation.
> For a start no specific configuration is needed, ipa-client-install
> should set all needed options.
Found my mistake. My clients were configured without trust, thus the krb5.conf had such
configurations in [realm] section.
kdc = ipaserver.ipadomain.com:88
master_kdc = ipaserver.ipadomain.com:88
admin_server = ipaserver.ipadomain.com:749
kpasswd_server = ipaserver.ipadomain.com:464
default_domain =
ipadomain.com
After re-installing clients with ipa-client-install, when the trust was established,
these lines were removed and authentication for AD users succeeded.
Without reinstalling, the definition of AD trust domain in [realm] sections also helped:
AD.DOMAIN = {
kdc = ad-controlled.ad.domain:88
}
> Please add 'debug_level = 9' to the [pam] and [domain/...] section in
> sssd.conf, restart SSSD, try to authenticate again and send the logs.
No need, i found already, that the problem was in SSSD cache, i had to wait a bit or
remove the cache in order to the updated HBAC rules were applied.
> bye,
> Sumit
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...