I've tried to join an Ubuntu machine (22.04, latest upgrade applied) to our
domain, composed of a root domain (ad.myshortdomain.it) and 4 other domain
(lom.ad.myshortdomain.it, ven.ad.myshortdomain.it, fvg.ad.myshortdomain.it, pug.ad.myshortdomain.it), in a forest.
I've joined the ubuntu box to one of the subdomain (ven.ad.myshortdomain.it).
Join worked as expected, but i was not able to authenticate.
I catch error like:
[...]
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [be_resolve_server_process] (0x0200): [RID#6] Found address for server lnfdc2.ad.myshortdomain.it: [10.7.5.22] TTL 2115
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_kinit_kdc_resolved] (0x1000): [RID#6] KDC resolved, attempting to get TGT...
[...]
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0100): [RID#6] Executing sasl bind mech: GSS-SPNEGO, user: CNL-RICERCA$
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [ad_sasl_log] (0x4000): [RID#6] SASL: GSSAPI client step 1
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [ad_sasl_log] (0x4000): [RID#6] SASL: GSSAPI client step 1
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [ad_sasl_log] (0x0040): [RID#6] SASL: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)
********************** BACKTRACE DUMP ENDS HERE *********************************
(2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0020): [RID#6] ldap_sasl_interactive_bind_s failed (-2)[Local error]
(2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_cli_connect_recv] (0x0040): [RID#6] Unable to establish connection [1432158227]: Authentication Failed
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE:
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0020): [RID#6] ldap_sasl_interactive_bind_s failed (-2)[Local error]
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sasl_bind_send] (0x0080): [RID#6] Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)]
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [child_sig_handler] (0x1000): [RID#6] Waiting for child [3942].
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [child_sig_handler] (0x0100): [RID#6] child [3942] finished successfully.
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_cli_connect_recv] (0x0040): [RID#6] Unable to establish connection [1432158227]: Authentication Failed
********************** BACKTRACE DUMP ENDS HERE *********************************
(2026-05-22 14:22:48): [be[ven.ad.myshortdomain.it]] [child_sig_handler] (0x0020): [RID#6] waitpid did not found a child with changed status.
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE:
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [_be_fo_set_port_status] (0x8000): [RID#6] Setting status: PORT_NOT_WORKING. Called from: ../src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_recv: 2125
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [fo_set_port_status] (0x0100): [RID#6] Marking port 389 of server 'lnfdc2.ad.myshortdomain.it' as 'not working'
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [fo_set_port_status] (0x0400): [RID#6] Marking port 389 of duplicate server 'lnfdc2.ad.myshortdomain.it' as 'not working'
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [sdap_handle_release] (0x2000): [RID#6] Trace: sh[0x61ee25d7b110], connected[1], ops[(nil)], ldap[0x61ee25d7aa80], destructor_lock[0], release_memory[0]
* (2026-05-22 14:22:47): [be[ven.ad.myshortdomain.it]] [remove_connection_callback] (0x4000): [RID#6] Successfully removed connection callback.
and i was forced to limit access to subdomain, adding in
/etc/sssd/sssd.conf:
ad_enabled_domains = ven.ad.myshortdomain.it
After that, still i catch errors that prevent me to open sessions, like:
* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_get_generic_op_finished] (0x0400): [RID#5] Search result: Referral(10), 0000202B: RefErr: DSID-0310079D, data 0, 1 access points ref 1: 'ad.myshortdomain.it'
* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_get_generic_ext_add_references] (0x1000): [RID#5] Additional References: ldap://ad.myshortdomain.it/cn=%7BA66B11F6-4E7E-42F7-A0C0-B1548B3378B7%7D,cn=policies,cn=system,DC=ad,DC=lnf,DC=it
* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_op_destructor] (0x2000): [RID#5] Operation 21 finished
* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sss_domain_get_state] (0x1000): [RID#5] Domain ven.ad.myshortdomain.it is Active
* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_send] (0x0020): [RID#5] Could not find domain matching [ad.myshortdomain.it]
********************** BACKTRACE DUMP ENDS HERE *********************************
(2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_done] (0x0040): [RID#5] Unable to get referred GPO attributes: [11](Risorsa temporaneamente non disponibile)
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE:
* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_op_done] (0x0200): [RID#5] communication error on cached connection, moving to next server
* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_op_done] (0x4000): [RID#5] advising for connection retry #1
* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_op_done] (0x4000): [RID#5] releasing operation connection
* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_id_release_conn_data] (0x4000): [RID#5] Releasing unused connection with fd [20]
* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [sdap_handle_release] (0x2000): [RID#5] Trace: sh[0x58cb6cdc3bc0], connected[1], ops[(nil)], ldap[0x58cb6cdc2c10], destructor_lock[0], release_memory[0]
* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [remove_connection_callback] (0x4000): [RID#5] Successfully removed connection callback.
* (2026-05-22 15:44:14): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_done] (0x0040): [RID#5] Unable to get referred GPO attributes: [11](Risorsa temporaneamente non disponibile)
********************** BACKTRACE DUMP ENDS HERE *********************************
(2026-05-22 15:46:44): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_som_attrs_done] (0x0040): [RID#11] no attrs found for SOM; try next SOM
* ... skipping repetitive backtrace ...
(2026-05-22 15:46:44): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_send] (0x0020): [RID#11] Could not find domain matching [ad.myshortdomain.it]
* ... skipping repetitive backtrace ...
(2026-05-22 15:46:44): [be[ven.ad.myshortdomain.it]] [ad_gpo_get_sd_referral_done] (0x0040): [RID#11] Unable to get referred GPO attributes: [11](Risorsa temporaneamente non disponibile)
* ... skipping repetitive backtrace ...
(2026-05-22 15:48:13): [be[ven.ad.myshortdomain.it]] [sbus_issue_request_done] (0x0040): sssd.dataprovider.pamHandler: Error [1432158213]: Terminated
(2026-05-22 15:48:13): [be[ven.ad.myshortdomain.it]] [sbus_issue_request_done] (0x0040): sssd.dataprovider.pamHandler: Error [1432158213]: Terminated
seems to me related to GPO, still of the root domain; i was forced to add
also to /etc/sssd/sssd.conf:
ad_gpo_access_control = disabled
ad_gpo_ignore_unreadable = True
ad_gpo_default_right = permit
What is wrong on my setup? Thanks.
--