Hi!
Nice! That seemed to do the trick after rebooting the client.
Is there a switch to set that up during "ipa-client-install" or should I use
configuration management to deploy that when needed?
Eemeli
-----Original Message-----
From: Sumit Bose <sbose(a)redhat.com>
Sent: torstai 5. syyskuuta 2019 19.03
To: Jokinen Eemeli <Eemeli.Jokinen(a)cinia.fi>
Cc: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>; Sumit Bose
<sbose(a)redhat.com>
Subject: Re: [Freeipa-users] Re: Problems joining an Ubuntu client to IPA server and using
AD Credentials
On Thu, Sep 05, 2019 at 03:03:17PM +0000, Jokinen Eemeli wrote:
Hi!
In the fact we're using RHEL 7 with ipa-server 4.6.4
Hi,
in this case please try to add
krb5_use_enterprise_principal = True
to the [domain/...] section of sssd.conf on the Ubuntu client.
HTH
bye,
Sumit
>
> Eemeli
>
> -----Original Message-----
> From: Sumit Bose via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org>
> Sent: torstai 5. syyskuuta 2019 16.36
> To: freeipa-users(a)lists.fedorahosted.org
> Cc: Sumit Bose <sbose(a)redhat.com>
> Subject: [Freeipa-users] Re: Problems joining an Ubuntu client to IPA
> server and using AD Credentials
>
> On Thu, Sep 05, 2019 at 01:11:44PM +0000, Jokinen Eemeli via FreeIPA-users wrote:
> > Hi!
> >
> > I have a problem I could use help on resolving:
> >
> > We have a working IPA Cluster and I try to join in with Ubuntu 16.04
> > freeipa-client. Everything seems to go smoothly, it creates config
> > files that look just right. However when I try to login with SSH
> > using AD Credentials I've joined the IPA with I can't login and
> > auth.log gives me an error
> >
> > --
> > Sep 5 15:46:29 testcomputer2 sshd[1907]: pam_unix(sshd:auth):
> > authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
> > rhost=<ip> user=<user>(a)<ad.domain> Sep 5 15:46:29
testcomputer2
> > sshd[1907]: pam_sss(sshd:auth): authentication failure; logname=
> > uid=0
> > euid=0 tty=ssh ruser= rhost=<ip> user=<user>(a)<ad.domain> Sep
5
> > 15:46:29 testcomputer2 sshd[1907]: pam_sss(sshd:auth): received for
> > user <user>(a)<ad.domain>: 4 (System error) Sep 5 15:46:31
> > testcomputer2 sshd[1907]: Failed password for <user>(a)<ad.domain>
> > from <ip> port 42416 ssh2
> > --
> >
> > Couldn't find anything solid but then I turned on debug levels and looked
into krb5_child.log. Our ipadomain is ipa.company.domain but for some reason it tries to
find the username from company.domain and of course it can't find the username there.
>
> Hi,
>
> which IPA version are you using on the server?
>
> It looks like you have defined the user principal name of the user in AD as
<user>(a)<company.domain>. Depending on the version of IPA there are two
different solutions.
>
> bye,
> Sumit
>
> >
> > --
> > (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]]
> > [tgt_req_child]
> > (0x1000): Attempting to get a TGT (Thu Sep 5 15:46:29 2019)
> > [[sssd[krb5_child[1909]]]] [get_and_save_tgt] (0x0400): Attempting
> > kinit for realm [<company.domain>] (Thu Sep 5 15:46:29 2019)
> > [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000):
> > [1909]
> > 1567687589.927017: Getting initial credentials for
> > <user>(a)<company.domain> (Thu Sep 5 15:46:29 2019)
> > [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000):
> > [1909]
> > 1567687589.927076: FAST armor ccache:
> > MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain>
> > (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]]
> > [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.927109:
> > Retrieving
> > host/testcomputer2.<ipa.company.domain>(a)<ipa.company.domain> ->
> > krb5_ccache_conf_data/fast_avail/krbtgt\/<company.domain>\@<company.
> > do
> > main>@X-CACHECONF: from
> > MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain> with result:
> > -1765328243/Matching credential not found (Thu Sep 5 15:46:29 2019)
> > [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000):
> > [1909]
> > 1567687589.927151: Sending request (172 bytes) to <company.domain>
> > (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]]
> > [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.938377:
> > Retrying AS request with master KDC (Thu Sep 5 15:46:29 2019)
> > [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000):
> > [1909]
> > 1567687589.938418: Getting initial credentials for
> > <user>(a)<company.domain> (Thu Sep 5 15:46:29 2019)
> > [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000):
> > [1909]
> > 1567687589.938442: FAST armor ccache:
> > MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain>
> > (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]]
> > [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.938467:
> > Retrieving
> > host/testcomputer2.<ipa.company.domain>(a)<ipa.company.domain> ->
> > krb5_ccache_conf_data/fast_avail/krbtgt\/<company.domain>\@<company.
> > do
> > main>@X-CACHECONF: from
> > MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain> with result:
-1765328243/Matching credential not found (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.938511:
Sending request (172 bytes) to <company.domain> (master) (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [get_and_save_tgt] (0x0020): 1232: [-1765328230][Cannot find
KDC for realm "<company.domain>"] (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [map_krb5_error] (0x0020): 1301: [-1765328230][Cannot find KDC
for realm "<company.domain>"] (Thu Sep 5 15:46:29 2019)
[[sssd[krb5_child[1909]]]] [k5c_send_data] (0x0200): Received error code 1432158209 (Thu
Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [pack_response_packet] (0x2000): response
packet size: [4] (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [k5c_send_data]
(0x4000): Response sent.
> > (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [main] (0x0400):
> > krb5_child completed successfully
> > --
> >
> > Seems like it converts ad.domain to company.domain and not to ipa.company.domain
for some reason. But like I said the configuration on /var/lib/sss/pubconf/krb5.include.d
seems legit.
> >
> > --
> > [domain_realm]
> > .<ad.domain> = <AD.DOMAIN>
> > <ad.domain> = <AD.DOMAIN>
> > [capaths]
> > <AD.DOMAIN> = {
> > <IPA.COMPANY.DOMAIN> = <AD.DOMAIN> } <IPA.COMPANY.DOMAIN> =
{
> > <AD.DOMAIN> = <AD.DOMAIN>
> > }
> > --
> >
> > Any ideas why it's dropping the subdomain out?
> >
> >
> > Eemeli
>
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to
> > freeipa-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
> >
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:
> >
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> >
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fed
> > or
> >
ahosted.org
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
>
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
>
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedor
>
ahosted.org