On Tue, Jan 29, 2019 at 11:19:22AM +0100, Ronald Wimmer via FreeIPA-users wrote:
I sucessfully registered my server server5.mydomain.at. After setting
up an
appropriate HBAC rule as well as setting the default domain in the sssd.conf
to a.mydomain.at I tried to connect to the server via SSH using:
myusername(a)MYDOMAIN.AT
This fails because the UPN seems to be picked:
[sssd[krb5_child[24704]]]: Client 'ronald.wimmer(a)MYDOMAIN.AT' not found in
Kerberos database
(After the migration to Office365 the UPN looks like
name.surname(a)mydomain.at.)
Since you redirected MYDOMAIN.AT to the IPA server in krb5.conf the
client cannot properly send the UPN to an AD DC.
You can disable UPN handling by setting
'ldap_user_principal = noSuchAttr' in the domain section of sssd.conf on
the IPA servers. You have to wait until the SSSD cache on the server
and the client are updated before the client would start using
employeeNumber(a)a.mydomain.at.
But I wonder if the redirection to the IPA server is needed in krb5.conf
at all ...
On other IPA clients the correct user is taken.
(employeeNumber(a)a.mydomain.at)
My /etc/krb5.conf looks like this:
[libdefaults]
default_realm = MYDOMAIN.AT
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
LINUX.MYDOMAIN.AT = {
kdc = ipa2.linux.mydomain.at:88
master_kdc = ipa2.linux.mydomain.at:88
admin_server = ipa2.linux.mydomain.at:749
kpasswd_server = ipa2.linux.mydomain.at:464
default_domain = linux.mydomain.at
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
MYDOMAIN.AT = {
kdc = ipa2.linux.mydomain.at:88
master_kdc = ipa2.linux.mydomain.at:88
admin_server = ipa2.linux.mydomain.at:749
kpasswd_server = ipa2.linux.mydomain.at:464
default_domain = mydomain.at
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.linux.mydomain.at = LINUX.MYDOMAIN.AT
linux.mydomain.at = LINUX.MYDOMAIN.AT
server5.mydomain.at = LINUX.MYDOMAIN.AT
.mydomain.at = MYDOMAIN.AT
If you replace this line with
.mydomain.at = LINUX.MYDOMAIN.AT
I would expect that libkrb5 will use the LINUX.MYDOMAIN.AT realm
whenever there is a DNS hostname from .mydomain.at is used. This way it
should be possible to add AD DCs to the MYDOMAIN.AT section so that
request which contain the realm explicitly like
'ronald.wimmer(a)MYDOMAIN.AT' would be send to an AD DCs.
Please let me know if you have a chance to test this and let me know the
result.
HTH
bye,
Sumit
>
> Why is this happening and what could I try?
>
> Cheers,
> Ronald
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...