On Fri, 22 Jan 2010 13:49:54 +0200 (EET)
Timo Aaltonen <tjaalton(a)cc.hut.fi> wrote:
Hi
I've understood that sssd still isn't fully tested against an
Active Directory? We've got one and I'm trying to make an Ubuntu
linux client to work with it by using samba, MIT krb5 libs and sssd.
Things aren't going too strong though. AD seems to support only HOST$
-style principals and not SPN's, but even if I specify
ldap_sasl_authid to that I only get an "Invalid credentials" when the
daemon is trying to bind
[sssd[be[AALTO]]] [sasl_bind_send] (4): Executing sasl bind mech:
GSSAPI, user: NEXUS6$ [sssd[be[AALTO]]] [sasl_bind_send] (1):
ldap_sasl_bind failed (49)[Invalid credentials]
So, am I missing something or is there something to be fixed :)
We have only experimental support to use AD as an LDAP server.
But I don't think we ever tested using the host keytab and kerberos to
authenticate system ldap connections agains it.
I think you should use winbind for now agtainst AD.
We have plans to integrate sssd with winbind at some point in the
future, but we have not done anything on that front yet.
Simo.
--
Simo Sorce * Red Hat, Inc * New York