On Sun, Feb 24, 2019 at 06:20:26AM -0000, Patrick Irish via FreeIPA-users wrote:
I've been fighting with this for 2 months. I've rebuilt both
the ad and ip server twice. Currently ipa and ad only contain a single unique user. AD
and ipa are on separate dns domains (
ad.domain.com and
int.domain.com respectively). AD
domain has windows pc joined to it. IPA server has linux server joined to it. Any help
is greatly appreciated.
AD server
Server:
dc0.ad.domain.com
Domain:
ad.domain.com
IP: 10.10.60.81
IPA server
Server:
identity.int.domain.com
domain
int.domain.com
IP: 10.10.60.61
What works on ipa server:
id aduser
getent passwd aduser
kinit aduser(a)ad.domain.com
what doesn't work
ssh 'aduse@ad.domain.com'(a)ipaserver
Password:
Password:
Password:
[localuser@ipaserver] su - aduser(a)ad.domain.com
Password:
su: Authentication failure
Hi,
the domain log only covers the lookup for the User Principal name and
email address. There should be lookups for the plain name with a search
filter which contains 'sAMAccountName=aduser' before the part you have
send. This part would be more interesting because the UPN and email
lookups are just a fallback for the case where the lookup with the plain
name does not return anything.
Additionally it would be good to see the sssd_nss.log as well since it
looks like the issues already happens during the name lookup before the
real authentication happens.
bye,
Sumit