On Fri, Sep 06, 2019 at 05:20:03AM +0000, Jokinen Eemeli wrote:
Hi!
Nice! That seemed to do the trick after rebooting the client.
Is there a switch to set that up during "ipa-client-install" or should I use
configuration management to deploy that when needed?
Hi,
recent version of SSSD should be able to determine automatically if
enterprise principals should be enabled or not. To investigate why this
did not happen in your case please let me know which version of SSSD you
are using and send the output of
ipa trust-show trusted.ad.forest.root
As a next step I might as you for the sssd_ipa.domain.log file with
debug_level=9 in the [domain/...] section of sssd.conf which covers the
startup of SSSD.
bye,
Sumit
>
>
> Eemeli
>
> -----Original Message-----
> From: Sumit Bose <sbose(a)redhat.com>
> Sent: torstai 5. syyskuuta 2019 19.03
> To: Jokinen Eemeli <Eemeli.Jokinen(a)cinia.fi>
> Cc: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>; Sumit Bose
<sbose(a)redhat.com>
> Subject: Re: [Freeipa-users] Re: Problems joining an Ubuntu client to IPA server and
using AD Credentials
>
> On Thu, Sep 05, 2019 at 03:03:17PM +0000, Jokinen Eemeli wrote:
> > Hi!
> >
> > In the fact we're using RHEL 7 with ipa-server 4.6.4
> >
>
> Hi,
>
> in this case please try to add
>
> krb5_use_enterprise_principal = True
>
> to the [domain/...] section of sssd.conf on the Ubuntu client.
>
> HTH
>
> bye,
> Sumit
>
> >
> > Eemeli
> >
> > -----Original Message-----
> > From: Sumit Bose via FreeIPA-users
> > <freeipa-users(a)lists.fedorahosted.org>
> > Sent: torstai 5. syyskuuta 2019 16.36
> > To: freeipa-users(a)lists.fedorahosted.org
> > Cc: Sumit Bose <sbose(a)redhat.com>
> > Subject: [Freeipa-users] Re: Problems joining an Ubuntu client to IPA
> > server and using AD Credentials
> >
> > On Thu, Sep 05, 2019 at 01:11:44PM +0000, Jokinen Eemeli via FreeIPA-users
wrote:
> > > Hi!
> > >
> > > I have a problem I could use help on resolving:
> > >
> > > We have a working IPA Cluster and I try to join in with Ubuntu 16.04
> > > freeipa-client. Everything seems to go smoothly, it creates config
> > > files that look just right. However when I try to login with SSH
> > > using AD Credentials I've joined the IPA with I can't login and
> > > auth.log gives me an error
> > >
> > > --
> > > Sep 5 15:46:29 testcomputer2 sshd[1907]: pam_unix(sshd:auth):
> > > authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
> > > rhost=<ip> user=<user>(a)<ad.domain> Sep 5 15:46:29
testcomputer2
> > > sshd[1907]: pam_sss(sshd:auth): authentication failure; logname=
> > > uid=0
> > > euid=0 tty=ssh ruser= rhost=<ip> user=<user>(a)<ad.domain>
Sep 5
> > > 15:46:29 testcomputer2 sshd[1907]: pam_sss(sshd:auth): received for
> > > user <user>(a)<ad.domain>: 4 (System error) Sep 5 15:46:31
> > > testcomputer2 sshd[1907]: Failed password for
<user>(a)<ad.domain>
> > > from <ip> port 42416 ssh2
> > > --
> > >
> > > Couldn't find anything solid but then I turned on debug levels and
looked into krb5_child.log. Our ipadomain is ipa.company.domain but for some reason it
tries to find the username from company.domain and of course it can't find the
username there.
> >
> > Hi,
> >
> > which IPA version are you using on the server?
> >
> > It looks like you have defined the user principal name of the user in AD as
<user>(a)<company.domain>. Depending on the version of IPA there are two
different solutions.
> >
> > bye,
> > Sumit
> >
> > >
> > > --
> > > (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]]
> > > [tgt_req_child]
> > > (0x1000): Attempting to get a TGT (Thu Sep 5 15:46:29 2019)
> > > [[sssd[krb5_child[1909]]]] [get_and_save_tgt] (0x0400): Attempting
> > > kinit for realm [<company.domain>] (Thu Sep 5 15:46:29 2019)
> > > [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000):
> > > [1909]
> > > 1567687589.927017: Getting initial credentials for
> > > <user>(a)<company.domain> (Thu Sep 5 15:46:29 2019)
> > > [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000):
> > > [1909]
> > > 1567687589.927076: FAST armor ccache:
> > > MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain>
> > > (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]]
> > > [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.927109:
> > > Retrieving
> > > host/testcomputer2.<ipa.company.domain>(a)<ipa.company.domain>
->
> > >
krb5_ccache_conf_data/fast_avail/krbtgt\/<company.domain>\@<company.
> > > do
> > > main>@X-CACHECONF: from
> > > MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain> with result:
> > > -1765328243/Matching credential not found (Thu Sep 5 15:46:29 2019)
> > > [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000):
> > > [1909]
> > > 1567687589.927151: Sending request (172 bytes) to <company.domain>
> > > (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]]
> > > [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.938377:
> > > Retrying AS request with master KDC (Thu Sep 5 15:46:29 2019)
> > > [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000):
> > > [1909]
> > > 1567687589.938418: Getting initial credentials for
> > > <user>(a)<company.domain> (Thu Sep 5 15:46:29 2019)
> > > [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000):
> > > [1909]
> > > 1567687589.938442: FAST armor ccache:
> > > MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain>
> > > (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]]
> > > [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.938467:
> > > Retrieving
> > > host/testcomputer2.<ipa.company.domain>(a)<ipa.company.domain>
->
> > >
krb5_ccache_conf_data/fast_avail/krbtgt\/<company.domain>\@<company.
> > > do
> > > main>@X-CACHECONF: from
> > > MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain> with result:
-1765328243/Matching credential not found (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.938511:
Sending request (172 bytes) to <company.domain> (master) (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [get_and_save_tgt] (0x0020): 1232: [-1765328230][Cannot find
KDC for realm "<company.domain>"] (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [map_krb5_error] (0x0020): 1301: [-1765328230][Cannot find KDC
for realm "<company.domain>"] (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [k5c_send_data] (0x0200): Received error code 1432158209 (Thu
Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [pack_response_packet] (0x2000): response
packet size: [4] (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [k5c_send_data]
(0x4000): Response sent.
> > > (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [main] (0x0400):
> > > krb5_child completed successfully
> > > --
> > >
> > > Seems like it converts ad.domain to company.domain and not to
ipa.company.domain for some reason. But like I said the configuration on
/var/lib/sss/pubconf/krb5.include.d seems legit.
> > >
> > > --
> > > [domain_realm]
> > > .<ad.domain> = <AD.DOMAIN>
> > > <ad.domain> = <AD.DOMAIN>
> > > [capaths]
> > > <AD.DOMAIN> = {
> > > <IPA.COMPANY.DOMAIN> = <AD.DOMAIN> }
<IPA.COMPANY.DOMAIN> = {
> > > <AD.DOMAIN> = <AD.DOMAIN>
> > > }
> > > --
> > >
> > > Any ideas why it's dropping the subdomain out?
> > >
> > >
> > > Eemeli
> >
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to
> > > freeipa-users-leave(a)lists.fedorahosted.org
> > > Fedora Code of Conduct:
> > >
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines:
> > >
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > >
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fed
> > > or
> > >
ahosted.org
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to
> > freeipa-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
> >
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:
> >
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> >
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedor
> >
ahosted.org