Main goal is to authenticate against multiple Kerberos Realms, AD domains without joining the Linux box to AD.
We have an AD forest with 2 trusted domains and as a result 2 kerberos realms, 1 per domain.
On RHEL5,6,7 I used pam_krb5 for authentication and passwd/group files for the user store. This allowed me to authenticate against AD for users in the passwd file that match the KBR5 principal. In system-auth/password-auth I would stack pam entries for each KRB5 REALM
passwd user: joe_doe
passwd user: joe_blow
system-auth
In this case either joe_doe or joe_blow can log in via AD credentials and pam would iterate through the stacked pam_krb5 entries to locate the matching krb5 principal
I am trying to replicate this on redhat enterprise linux 8. I am aware pam_krb5 is not an option and that sssd is the default for this use case. What I cannot figure out is how to authenticate against multiple Domains in SSSD. If I define 1 domain in sssd.conf with id_provider = files. I can authenticate fine against the single domain/kerberos5 realm.
If I add multiple domains, sssd does not iterate through them, it fails if it does not find the user in the first domain.
Is what I am attempting possible without joining AD and using the provider of AD? I would like to avoid this at all costs.
Thanks