Hi!
In the fact we're using RHEL 7 with ipa-server 4.6.4
Eemeli
-----Original Message-----
From: Sumit Bose via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
Sent: torstai 5. syyskuuta 2019 16.36
To: freeipa-users(a)lists.fedorahosted.org
Cc: Sumit Bose <sbose(a)redhat.com>
Subject: [Freeipa-users] Re: Problems joining an Ubuntu client to IPA server and using AD
Credentials
On Thu, Sep 05, 2019 at 01:11:44PM +0000, Jokinen Eemeli via FreeIPA-users wrote:
Hi!
I have a problem I could use help on resolving:
We have a working IPA Cluster and I try to join in with Ubuntu 16.04
freeipa-client. Everything seems to go smoothly, it creates config
files that look just right. However when I try to login with SSH using
AD Credentials I've joined the IPA with I can't login and auth.log
gives me an error
--
Sep 5 15:46:29 testcomputer2 sshd[1907]: pam_unix(sshd:auth):
authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
rhost=<ip> user=<user>(a)<ad.domain> Sep 5 15:46:29 testcomputer2
sshd[1907]: pam_sss(sshd:auth): authentication failure; logname= uid=0
euid=0 tty=ssh ruser= rhost=<ip> user=<user>(a)<ad.domain> Sep 5
15:46:29 testcomputer2 sshd[1907]: pam_sss(sshd:auth): received for
user <user>(a)<ad.domain>: 4 (System error) Sep 5 15:46:31
testcomputer2 sshd[1907]: Failed password for <user>(a)<ad.domain> from
<ip> port 42416 ssh2
--
Couldn't find anything solid but then I turned on debug levels and looked into
krb5_child.log. Our ipadomain is ipa.company.domain but for some reason it tries to find
the username from company.domain and of course it can't find the username there.
Hi,
which IPA version are you using on the server?
It looks like you have defined the user principal name of the user in AD as
<user>(a)<company.domain>. Depending on the version of IPA there are two
different solutions.
bye,
Sumit
--
(Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [tgt_req_child]
(0x1000): Attempting to get a TGT (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [get_and_save_tgt] (0x0400): Attempting
kinit for realm [<company.domain>] (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909]
1567687589.927017: Getting initial credentials for
<user>(a)<company.domain> (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909]
1567687589.927076: FAST armor ccache:
MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain>
(Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]]
[sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.927109:
Retrieving
host/testcomputer2.<ipa.company.domain>(a)<ipa.company.domain> ->
krb5_ccache_conf_data/fast_avail/krbtgt\/<company.domain>\(a)<company.do
main>@X-CACHECONF: from
MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain> with result:
-1765328243/Matching credential not found (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909]
1567687589.927151: Sending request (172 bytes) to <company.domain>
(Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]]
[sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.938377: Retrying
AS request with master KDC (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909]
1567687589.938418: Getting initial credentials for
<user>(a)<company.domain> (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909]
1567687589.938442: FAST armor ccache:
MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain>
(Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]]
[sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.938467:
Retrieving
host/testcomputer2.<ipa.company.domain>(a)<ipa.company.domain> ->
krb5_ccache_conf_data/fast_avail/krbtgt\/<company.domain>\(a)<company.do
main>@X-CACHECONF: from
MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain> with result:
-1765328243/Matching credential not found (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.938511:
Sending request (172 bytes) to <company.domain> (master) (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [get_and_save_tgt] (0x0020): 1232: [-1765328230][Cannot find
KDC for realm "<company.domain>"] (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [map_krb5_error] (0x0020): 1301: [-1765328230][Cannot find KDC
for realm "<company.domain>"] (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [k5c_send_data] (0x0200): Received error code 1432158209 (Thu
Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [pack_response_packet] (0x2000): response
packet size: [4] (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [k5c_send_data]
(0x4000): Response sent.
(Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [main] (0x0400):
krb5_child completed successfully
--
Seems like it converts ad.domain to company.domain and not to ipa.company.domain for some
reason. But like I said the configuration on /var/lib/sss/pubconf/krb5.include.d seems
legit.
--
[domain_realm]
.<ad.domain> = <AD.DOMAIN>
<ad.domain> = <AD.DOMAIN>
[capaths]
<AD.DOMAIN> = {
<IPA.COMPANY.DOMAIN> = <AD.DOMAIN>
}
<IPA.COMPANY.DOMAIN> = {
<AD.DOMAIN> = <AD.DOMAIN>
}
--
Any ideas why it's dropping the subdomain out?
Eemeli
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedor
ahosted.org
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...