On ti, 29 tammi 2019, Ronald Wimmer via FreeIPA-users wrote:
I sucessfully registered my server server5.mydomain.at. After setting up an appropriate HBAC rule as well as setting the default domain in the sssd.conf to a.mydomain.at I tried to connect to the server via SSH using:
myusername@MYDOMAIN.AT
This fails because the UPN seems to be picked:
[sssd[krb5_child[24704]]]: Client 'ronald.wimmer@MYDOMAIN.AT' not found in Kerberos database
(After the migration to Office365 the UPN looks like name.surname@mydomain.at.)
On other IPA clients the correct user is taken. (employeeNumber@a.mydomain.at)
My /etc/krb5.conf looks like this:
I think you need to tune sssd configuration here. Sumit or Jakub may have more details on what exact options should be used.