I am using a Idm setup which has AD trust configured.
IPADEV.EXAMPLE.LOCAL is the IPA realm
EXAMPLE.LOCAL is the AD realm
I can ssh to both ipa servers with AD credentials , but cannot ssh to the ipa clients. I
have enabled debug for almost all services in sssd and the only one which seems to be
related to the issue is this one:
[[sssd[krb5_child[29926]]]] [sss_child_krb5_trace_cb] (0x4000): [29926] 1619534544.375456:
Getting initial credentials for user.email\@COMPANY.COM(a)IPADEV.EXAMPLE.LOCAL
[[sssd[krb5_child[29926]]]] [get_and_save_tgt] (0x0020): 1695: [-1765328378][Client
'user.email@COMPANY.COM(a)IPADEV.EXAMPLE.LOCAL' not found in Kerberos database]
What i do not understand is why does it use UPN (in the user.email format) to query for
the user .
I can run id, getent passwd, etc and all userids/gids are resolved.
I have tried many settings in sssd.conf , both on the client and server side, but none of
them helped.
Bellow are the sssd.conf and krb5.conf from the client:
sssd.conf
========
[domain/ipadev.example.local]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = ipadev.example.local
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ldap_tls_cacert = /etc/ipa/ca.crt
ipa_hostname = ipadev02.example.local
chpass_provider = ipa
ipa_server = _srv_, ipadev04.example.local, ipadev05.example.local
#dns_discovery_domain = ipadev.example.local
debug_level = 9
krb5_auth_timeout = 30
[sssd]
domain_resolution_order = example.local, ipadev.example.local
services = nss, sudo, pam, ssh, ifp
domains = ipadev.example.local
debug_level = 9
[nss]
homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
debug_level = 9
[pac]
[ifp]
[secrets]
[session_recording]
krb5.conf
========
#File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = IPADEV.EXAMPLE.LOCAL
dns_lookup_realm = true
dns_lookup_kdc = true
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
IPADEV.EXAMPLE.LOCAL = {
kdc = ipadev04.example.local:88
master_kdc = ipadev04.example.local:88
admin_server = ipadev04.example.local:749
kpasswd_server = ipadev04.example.local:464
kdc = ipadev05.example.local:88
master_kdc = ipadev05.example.local:88
admin_server = ipadev05.example.local:749
kpasswd_server = ipadev05.example.local:464
default_domain = ipadev.example.local
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.ipadev.example.local = IPADEV.EXAMPLE.LOCAL
ipadev.example.local = IPADEV.EXAMPLE.LOCAL
ipadev02.example.local = IPADEV.EXAMPLE.LOCAL
.example.local = IPADEV.EXAMPLE.LOCAL
example.local = IPADEV.EXAMPLE.LOCAL
Show replies by date