Iulian,
> I can ssh to both ipa servers with AD credentials , but cannot
ssh to the ipa clients. I have enabled debug for almost all services in sssd and the only
one which seems to be related to the issue is this one:
Do you have any HBAC rules in place preventing AD users from logging into the clients?
What do the auth logs manifest during an attempted login?
> What i do not understand is why does it use UPN (in the
user.email format) to query for the user .
We had to configure "krb5_use_enterprise_principal = true" in the
[domain/ipa.domain] section within sssd.conf to get trusted logins functioning on our
clients.
HTH,
John DeSantis
On 4/27/21 11:23 AM, iulian roman via FreeIPA-users wrote:
> I am using a Idm setup which has AD trust configured.
>
> IPADEV.EXAMPLE.LOCAL is the IPA realm
> EXAMPLE.LOCAL is the AD realm
>
> I can ssh to both ipa servers with AD credentials , but cannot ssh to the ipa
clients. I have enabled debug for almost all services in sssd and the only one which seems
to be related to the issue is this one:
>
> [[sssd[krb5_child[29926]]]] [sss_child_krb5_trace_cb] (0x4000): [29926]
1619534544.375456: Getting initial credentials for
user.email\@COMPANY.COM(a)IPADEV.EXAMPLE.LOCAL
>
> [[sssd[krb5_child[29926]]]] [get_and_save_tgt] (0x0020): 1695: [-1765328378][Client
'user.email@COMPANY.COM(a)IPADEV.EXAMPLE.LOCAL' not found in Kerberos database]
>
> What i do not understand is why does it use UPN (in the user.email format) to query
for the user .
>
> I can run id, getent passwd, etc and all userids/gids are resolved.
>
> I have tried many settings in sssd.conf , both on the client and server side, but
none of them helped.
>
> Bellow are the sssd.conf and krb5.conf from the client:
>
> sssd.conf
> ========
> [domain/ipadev.example.local]
>
> cache_credentials = True
> krb5_store_password_if_offline = True
> ipa_domain = ipadev.example.local
> id_provider = ipa
> auth_provider = ipa
> access_provider = ipa
> ldap_tls_cacert = /etc/ipa/ca.crt
> ipa_hostname = ipadev02.example.local
> chpass_provider = ipa
> ipa_server = _srv_, ipadev04.example.local, ipadev05.example.local
> #dns_discovery_domain = ipadev.example.local
> debug_level = 9
> krb5_auth_timeout = 30
> [sssd]
> domain_resolution_order = example.local, ipadev.example.local
> services = nss, sudo, pam, ssh, ifp
>
> domains = ipadev.example.local
> debug_level = 9
> [nss]
> homedir_substring = /home
>
> [pam]
>
> [sudo]
>
> [autofs]
>
> [ssh]
> debug_level = 9
>
> [pac]
>
> [ifp]
>
> [secrets]
>
> [session_recording]
>
> krb5.conf
> ========
> #File modified by ipa-client-install
>
> includedir /etc/krb5.conf.d/
> includedir /var/lib/sss/pubconf/krb5.include.d/
>
> [libdefaults]
> default_realm = IPADEV.EXAMPLE.LOCAL
> dns_lookup_realm = true
> dns_lookup_kdc = true
> rdns = false
> dns_canonicalize_hostname = false
> ticket_lifetime = 24h
> forwardable = true
> udp_preference_limit = 0
> default_ccache_name = KEYRING:persistent:%{uid}
>
>
> [realms]
> IPADEV.EXAMPLE.LOCAL = {
> kdc = ipadev04.example.local:88
> master_kdc = ipadev04.example.local:88
> admin_server = ipadev04.example.local:749
> kpasswd_server = ipadev04.example.local:464
> kdc = ipadev05.example.local:88
> master_kdc = ipadev05.example.local:88
> admin_server = ipadev05.example.local:749
> kpasswd_server = ipadev05.example.local:464
> default_domain = ipadev.example.local
> pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
> pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
>
> }
>
>
> [domain_realm]
> .ipadev.example.local = IPADEV.EXAMPLE.LOCAL
> ipadev.example.local = IPADEV.EXAMPLE.LOCAL
> ipadev02.example.local = IPADEV.EXAMPLE.LOCAL
> .example.local = IPADEV.EXAMPLE.LOCAL
> example.local = IPADEV.EXAMPLE.LOCAL
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fe...
> List Guidelines:
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorap...
> List Archives:
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.f...
> Do not reply to spam on the list, report it:
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpagure....
> [EXTERNAL EMAIL] DO NOT CLICK links or attachments unless you recognize the sender
and know the content is safe.
>