No netgroup_provider?
by Spike White
All,
Spoiler alert: my configuration is working; I just want verification I
did it right.
BACKGROUND:
I have an LDAP domain that was delivering autofs maps exclusively. Other
(AD) domains were delivering users, groups, authentication and access.
Since this back-end LDAP domain didn’t participate in any user
authentication or access, I configured that backup LDAP domain in sssd.conf
with only an autofs_provder:
[domain/LDAP]
debug_level = 9
id_provider = none
autofs_provider = ldap
ldap_uri= ldap://austgcore17.example.com
ldap_schema = rfc2307bis
ldap_default_bind_dn = cn=ldapadm,dc=itzgeek,dc=local
ldap_default_authtok = ldppassword
ldap_autofs_search_base = ou=automount,ou=admin,dc=itzgeek,dc=local
ldap_autofs_map_object_class = automountMap
ldap_autofs_map_name = automountMapName
ldap_autofs_entry_object_class = automount
ldap_autofs_entry_key = automountKey
ldap_autofs_entry_value = automountInformation
ldap_netgroup_search_base = ou=netgroup,ou=admin,dc=itzgeek,dc=local
Works great! Get all expected automount maps.
CURRENT (ADDED NETGROUPS):
Now I have added NIS netgroups to this backend LDAP server. Thus, it now
successfully delivers automount maps + netgroups.
I still don’t want this LDAP backend domain to even attempt authentication
and access – that’s in my other (AD) domains.
So you’d think all I’d have to do is change this:
[domain/LDAP]
…
id_provider = none
autofs_provider = ldap
to this:
[domain/LDAP]
…
id_provider = none
autofs_provider = ldap
netgroup_provider = ldap
But – point in fact – there is no “netgroup_provider” setting for sssd.conf
file. Netgroup takes whatever the value is of ‘id_provider’.
So I turned on id_provider, then explicitly turned off all providers I
don’t want. Is this correct?
[domain/LDAP]
debug_level = 9
#id_provider = none
id_provider = ldap
auth_provider = none
account_provider = none
chpass_provider = none
sudo_provider = none
subdomains_provider = none
autofs_provider = ldap
Also, any particular reason there’s not a netgroup_provider?
BTW, retrieving netgroups via sssd does not seem explicitly and concretely
documented. That is, I had to consult multiple sources to get the RFC
2307bis setup, another to get the sssd.conf settings. (I’m not faulting
anyone; netgroups are rarely used anymore.)
Is there someone that maintains sssd documentation, I could submit a
concrete example – to help any future intrepid explorer? I have the
specific back-end LDIF files, the specific sssd.conf and nsswitch.conf
file setup.
Spike White
5 years, 2 months
Any way to disallow unauthorized users in the pam "authentication" phase instead of "account" phase?
by Spike White
All,
This is not a big deal -- just curious.
We have a commercial Linux AD integration product. In it, the incoming
user's authorization to log in is validated during the PAM "authentication"
phase. So if it's a legal AD user and good password, but that user is not
authorized in -- you're returned to the "login name: / password:" prompt.
In sssd, it appears that validating if you're a legally-authorized user or
in a legally-authorized group occurs in the PAM "account" phase. It's done
by the "simple" access_provider.
Consider again a legal AD user and good password, but again -- that user is
not authorized in.
Now that user name is accepted, that password is accepted, but then the
server closes your putty session. You're not returned to a "login name: /
password:" prompt.
Like I say -- not a big deal. Unauthorized users are intercepted and
disallowed, just in different ways. Just curious if there's a way to make
sssd fail in the former manner, instead of the latter.
Spike White
5 years, 2 months
SSO works on one server but not the other (reinstall?)
by Hans Schou
Hi
I have two servers "L" & "R" which are connected to the AD.
On server L I can login with SSO and I don't have to type password.
On server R I can't login with SSO and I have to type the AD password.
The user is only defined in the AD not locally.
I have tried "realm leave" + "realm join" and "sss_cache -E".
Removed
/etc/sssd/*
/etc/krb5.keytab
/var/lib/sss/db/*
to make sure no config was leftover.
The /etc/sssd/sssd.conf is equal on both servers.
Both servers are running RHEL 7.6.
/etc/sssd/sssd.conf :
[sssd]
domains = acme.com
config_file_version = 2
services = nss, pam
[domain/acme.com]
ad_domain = acme.com
krb5_realm = ACME.COM
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%u
access_provider = ad
debug_level = 7
Any hint much appreciated.
best regards
Hans
5 years, 2 months
smartcard cert mapping offline (AD)
by Winberg, Adam
I'm having a hard time understanding how cert mapping is supposed to work
offline. Currently I have the following certmap config (this is on
RHEL8-beta):
[certmap/ad.example.com/smartcard]
maprule =
(|(userPrincipal={subject_principal})(samAccountName={subject_principal.short_name}))
to map the CN on the card to 'samAccountName' in AD. This works as long as
I'm online (access to AD), but when I go offline (disconnect network) the
maprule is not working. I thought that the mapping would then use the sssd
cache but apparantly not - so how is smartcard login supposed to work
offline?
Regards
Adam
5 years, 2 months
Cant get new TGT after kdestroy on gdm login with smartcard.
by Winberg, Adam
I am having problems consistently getting a TGT after logging in via GDM
with smartcard. On first login it normally works, but if I do a 'kdestroy'
and then logout of my gnome session, I don't get a new TGT when I login to
a new session. Instead, the root user has a TGT for my AD user:
[a001329@c20693 ~]$ klist
klist: Credentials cache 'KCM:60483' not found
[root@c20693 ~]# klist
Ticket cache: KCM:0:63363
Default principal: a001329(a)EXAMPLE.COM
Valid starting Expires Service principal
2019-02-13 15:11:38 2019-02-14 01:11:33 krbtgt/EXAMPLE.com(a)EXAMPLE.com
renew until 2019-02-20 15:11:33
A wild guess is that krb5-pkinit works by letting the root user get a TGT
for my user and then transfer that cache to my user, or something? In my
case that transfer does not happen if I previously performed a kdestroy.
From krb5_child.log:
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]]
[sss_get_ccache_name_for_principal] (0x4000): Location: [KCM:]
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]]
[sss_get_ccache_name_for_principal] (0x4000): tmp_ccname: [KCM:0:71555]
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache]
(0x4000): Initializing ccache of type [KCM]
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache]
(0x4000): CC supports switch
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache]
(0x4000): returning: 0
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]]
[safe_remove_old_ccache_file] (0x0400): New and old ccache file are the
same, none will be deleted.
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [k5c_send_data]
(0x0200): Received error code 0
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]]
[pack_response_packet] (0x2000): response packet size: [95]
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [k5c_send_data]
(0x4000): Response sent.
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [main] (0x0400):
krb5_child completed successfully
After a while (not sure how long) it works as expected again, presumably
after a timeout of some sort.
If I disable KCM (by removing /etc/krb5.conf.d/kcm_default_ccache) TGT
retrieval works as expected. Am I missing something or is this a bug?
Regards,
Adam
5 years, 2 months
Password expiration odd behavior with SUDO
by Gabe Pacuilla
Version: sssd-1.16.2-13.el7.x86_64
Hello All,
I've been working with SSSD using FreeIPA directory services, and I've noticed this odd behavior when passwords expire and prompted to change on auth:
---
ipa-user@host:~$ sudo su -
[sudo] password for ipa-user: <Enter password>
Password expired. Change your password now.
sudo: Account or password is expired, reset your password and try again
Current Password: <Hit Ctrl+C here>
sudo: unable to change expired password: Authentication token manipulation error
ipa-user@host:~$ ^C
ipa-user@host:~$ ^C
ipa-user@host:~$ ^C
ipa-user@host:~$ sudo su -
Last login: blah
[root@host ~]#
---
I don't believe we should be able to cancel out of expired password change and subsequently be able to authenticate without any prompt? It appears the sudo ticket is generated before the password expiration prompt is shown.
This seems like breaking behavior since the password expiration is not really being enforced, and in our environment we'll only use passwords for sudo (ssh keys for remote login).
For what it's worth, here's the contents of pam system-auth config:
---
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session optional pam_oddjob_mkhomedir.so umask=0077
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
---
Thanks in advance for any insight,
-Gabe
5 years, 2 months
AD 2016 integration GPO weirdness
by Emil Petersson
Hi,
I am trying to configure Active Directory integration with SSSD. AD is running on 2016, and my clients are CentOS 7.6, running SSSD 1.16.2-13.el7.
I want to control client access using AD GPO.
The issue I'm seeing is that any user is allowed to log on to the client, regardless if they are allowed by a GPO or not.
The clients were successfully joined to AD by running:
realm join --user=username --computer-ou='OU=Linux,OU=Servers,OU=XXX,DC=XXX,DC=XXX,DC=net' xxx.xxx.net
The client sssd.conf looks like this:
[sssd]
domains = xxx.xxx.net
config_file_version = 2
services = nss, pam
full_name_format = %1$s
default_domain_suffix = xxx.xxx.net
[domain/xxx.xxx.net]
debug_level = 9
ad_domain = xxx.xxx.net
krb5_realm = XXX.XXX.NET
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
ad_gpo_access_control = enforcing
dyndns_update = false
When trying to log in with an unauthorized user, I get the following output from SSSD debug:
[ad_gpo_perform_hbac_processing] (0x4000): allow_key: SeRemoteInteractiveLogonRight
[ad_gpo_perform_hbac_processing] (0x4000): deny_key: SeDenyRemoteInteractiveLogonRight
[parse_policy_setting_value] (0x0400): No value for key [SeRemoteInteractiveLogonRight] found in gpo result
[ad_gpo_access_check] (0x0400): RESULTANT POLICY:
[ad_gpo_access_check] (0x0400): gpo_map_type: Remote Interactive
[ad_gpo_access_check] (0x0400): allowed_size = 0
[ad_gpo_access_check] (0x0400): denied_size = 3
[ad_gpo_access_check] (0x0400): denied_sids[0] = S-1-5-21-1107582786-1995068826-2594897426-4406
[ad_gpo_access_check] (0x0400): denied_sids[1] = S-1-5-21-1107582786-1995068826-2594897426-4281
[ad_gpo_access_check] (0x0400): denied_sids[2] = S-1-5-21-1107582786-1995068826-2594897426-4021
[ad_gpo_access_check] (0x0400): CURRENT USER:
[ad_gpo_access_check] (0x0400): user_sid = S-1-5-21-1107582786-1995068826-2594897426-5609
[ad_gpo_access_check] (0x0400): group_sids[0] = S-1-5-21-1107582786-1995068826-2594897426-5611
[ad_gpo_access_check] (0x0400): group_sids[1] = S-1-5-21-1107582786-1995068826-2594897426-513
[ad_gpo_access_check] (0x0400): group_sids[2] = S-1-5-21-1107582786-1995068826-2594897426-5612
[ad_gpo_access_check] (0x0400): group_sids[3] = S-1-5-11
[ad_gpo_access_check] (0x0400): POLICY DECISION:
[ad_gpo_access_check] (0x0400): access_granted = 1
[ad_gpo_access_check] (0x0400): access_denied = 0
[ad_gpo_access_done] (0x0400): GPO-based access control successful.
I'm not understanding what's happening here. It's as if my test user is allowed by default. Could this be due to a PAM config?
I was expecting to be denied login until I've explicitly setup a GPO to allow login :)
Any help is much appreciated!
5 years, 2 months
password not complex enough error for AD users
by robert wild
hi all,
i have got sssd on a centos 7 vm and i have got it working
https://www.linuxtechi.com/integrate-rhel7-centos7-windows-active-directory/
as when i do
id AD_user
it comes up with the uid, gid and all the group members that user belongs to also they can login on the logon page using there AD accounts
but when they open up a terminal window i want it so they can change there passwords
i have added to my "/etc/sssd/sssd.conf" file these two lines from this link
https://linux.die.net/man/5/sssd.conf
pwd_expiration_warning = 7
chpass_provider = ad
but they get this error when they try to change there passwords
[robert.wild@lon-p-xrdp01 ~]$ passwd
Changing password for user robert.wild.
Current Password:
New password:
Retype new password:
Password change failed. Server message: Please make sure the password meets the complexity constraints.
passwd: Authentication token manipulation error
[robert.wild@lon-p-xrdp01 ~]$
but i know i do meet the password requirements as i have added 13 characters including upper/lower/numbers/special characters
has anyone got sssd to change user passwords
thanks,
rob
5 years, 2 months
AD multiple domains - login failed for child domain
by Jeremy Monnet
Hello,
I never fixed issues I had last year
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahoste...
but I did made a new test on a brand new ubuntu up to date, and the
result is far better, though everything is not working.
As a reminder, I have an AD with a parent and a child domain, let's
say example.com and child.example.com. For the new server I set up, I
used system provided utilities
realm join example.com -U 'user(a)EXAMPLE.COM'
which pretty much generates
root@ubuntu:/var/log/sssd# cat /etc/sssd/sssd.conf
[sssd]
domains = example.com
config_file_version = 2
services = nss, pam
[domain/example.com]
ad_domain = example.com
krb5_realm = EXAMPLE.COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
fallback_homedir = /home/%u@%d
debug_level=9
access_provider = ad
Now, everything is OK with the main domain, AFAIK, I can login, sudo
based on groups, etc. But for the child domain, most work, I can id a
user@child (that resolves the user and the groups associated), I can
"su - user@child" from root, BUT I can not login with that user@child.
Sanitized logs follow :
sssd_example.com.log
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [get_server_status]
(0x1000): Status of server '<ad>' is 'working'
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [get_port_status]
(0x1000): Port status of port 389 for server '<ad>' is 'working'
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]]
[fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to
6 seconds
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [resolve_srv_send]
(0x0200): The status of SRV lookup is resolved
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [get_server_status]
(0x1000): Status of server '<ad>' is 'working'
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]]
[be_resolve_server_process] (0x1000): Saving the first resolved server
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]]
[be_resolve_server_process] (0x0200): Found address for server <ad>:
[IP] TTL 3600
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]]
[ad_resolve_callback] (0x0100): Constructed uri 'ldap://<ad>'
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]]
[ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://<ad>'
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]]
[unique_filename_destructor] (0x2000): Unlinking
[/var/lib/sss/pubconf/.krb5info_dummy_ivIwhy]
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [unlink_dbg]
(0x2000): File already removed:
[/var/lib/sss/pubconf/.krb5info_dummy_ivIwhy]
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]]
[sss_domain_get_state] (0x1000): Domain child.example.com is Active
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]]
[child_handler_setup] (0x2000): Setting up signal handler up for pid
[30303]
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]]
[child_handler_setup] (0x2000): Signal handler set up for pid [30303]
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]]
[write_pipe_handler] (0x0400): All data has been sent!
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [read_pipe_handler]
(0x0400): EOF received, client finished
(Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [krb5_auth_done]
(0x0040): The krb5_child process returned an error. Please inspect the
krb5_child.log file or the journal for more information
krb5_child.log
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393070: Sending
TCP request to stream <IP>:88
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393071:
Received answer (317 bytes) from stream <IP>:88
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393072:
Terminating TCP connection to stream <IP>:88
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393073:
Response was from master KDC
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393074:
Decoding FAST response
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393075: TGS
request result: -1765328377/Server not found in Kerberos database
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393076:
Requesting tickets for RestrictedKrbHost/ubuntu(a)EXAMPLE.COM, referrals
off
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393077:
Generated subkey for TGS request: rc4-hmac/1624
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393078: etypes
requested in TGS request: aes256-cts, aes128-cts, aes256-sha2,
aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393080:
Encoding request body and padata into FAST request
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393081: Sending
request (1719 bytes) to EXAMPLE.COM
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393082:
Initiating TCP connection to stream <IP>:88
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393083: Sending
TCP request to stream <IP>:88
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393084:
Received answer (317 bytes) from stream <IP>:88
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393085:
Terminating TCP connection to stream <IP>:88
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393086:
Response was from master KDC
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393087:
Decoding FAST response
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393088: TGS
request result: -1765328377/Server not found in Kerberos database
(Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]]
[sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393089:
Destroying ccache MEMORY:xwkvpg9
Do you have any idea why the server is not found in the child domain ?
Could that be because the wrong server principal may be used ?
Thanks for your help !
Jeremy
5 years, 2 months
SSSD : id don't display groups name subdomain (Child trust)
by Martial CHAVIGNY
Hi everyone,
In dev environnement, with SSSD 1.16.2 (release 13.el7_6.5) on RHEL 7.6
SSSD is configured to request on mch.dev domain. trusted subdomain sub.mch.dev exist (Win2k16)
On mch.dev, I have an user 'user1' in Universal groups 'G_TEST' and 'allowed_ssh'. These groups are placed also in mch.dev domain.
On sub.mch.dev, I have user 'user2' only. 'user2' is place in 'G_TEST' and 'allowed_ssh'.
When get id user from mch.dev domain, by `id mch\user1` I get this result : `uid=83701115(user1) gid=513(sssdgrp) groups=513(sssdgrp),83701107(allowed_ssh),83701117(g_test)`, but `id sub\user2`, in same group (universal - child trust), I get `uid=69901104(user2) gid=69901104(user2) groups=69901104(user2)` without group name
getent work fine : `getent group 'g_test'` result : `g_test:*:83701117:user2,user1,mch`
Why I have not groupname for user2 ?
sssd.conf :
[sssd]
domains = mch.dev
config_file_version = 2
services = nss, pam
default_domain_suffix = mch.dev
full_name_format = %1$s
[nss]
filter_users = root
reconnection_retries = 3
entry_cache_nowait_percentage = 75
[pam]
pam_pwd_expiration_warning = 21
pam_account_expired_message = Account/password expired, please use selfservice portal to change your password and logon again.
[domain/MCH.DEV]
debug_level = 9
id_provider = ad
access_provider = ad
auth_provider = ad
ad_domain = mch.dev
krb5_realm = MCH.DEV
krb5_store_password_if_offline = True
cache_credentials = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
override_gid = 513
fallback_homedir = /home/%u@%d
default_shell = /bin/bash
dyndns_update = false
ldap_idmap_range_min = 100000
ldap_use_tokengroups = False
krb5.conf
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_ccache_name = KEYRING:persistent:%{uid}
default_realm = MCH.DEV
[realms]
MCH.DEV = {
}
[domain_realm]
mch.dev = MCH.DEV
.mch.dev = MCH.DEV
Logs available here: https://pastebin.com/Ntt62Cxt
Thanks in advance
@Jakub Hrozek jhrozek(a)redhat.com<mailto:jhrozek@redhat.com>
With the configuration above, Inverse of your problem : I can't view and use group for sub domain user, but I can login with SSH like this : 'ssh -l 'sub\user2' 172.31.8.88'
5 years, 2 months