On Wed, Apr 20, 2016 at 04:14:49AM -0000, rolla.matthieu(a)gmail.com wrote:
Hello, I was using previously sssd to authenticate my user using
id_provider = LDAP and it works great.
Now that my samba 4 DC is configured and that the GPO can finally be used, I reconfigured
sssd with realmd to be able to use sssd-ad to centralize the authentification for some
services via the GPO.
SSSD was configured automatically by realm as expected and the server is registrer in the
appropriate OU as define in /etc/realmd.conf in my DC. I can also successfully retrieve
my users/group info with getent and id.
Following the example presented here
https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration, I notice that
when I try to authenticate a user with SSH I can see errors relative to the retrieve of
the GPO
http://pastebin.com/6wzXUrCr
Can you check/send the gpo_child log file as well?
bye,
Sumit
>
>
> Here is my sssd,confconfiguration:
>
> [sssd]
> config_file_version = 2
> services = nss, pam
> domains =
hq.mydc.com
>
> [nss]
> # Ensure that certain users are not authenticated from network accounts
> filter_users =
root,lightdm,nslcd,dnsmasq,dbus,avahi,avahi-autoipd,backup,beagleindex,bin,daemon,games,gdm,gnats,haldaemon,hplip,irc,ivman,klog,libuuid,list,lp,mail,man,messagebus,mysql,news,ntp,openldap,polkituser,proxy,pulse,puppet,saned,sshd,sync,sys,syslog,uucp,vde2-net,www-data
> filter_groups = root
>
> [pam]
>
> [
domain/hq.mydc.com]
<----------------------- this part was generated automatically
> debug_level = 9
> ad_domain =
hq.mydc.com
> krb5_realm =
HQ.mydc.COM
> realmd_tags = manages-system joined-with-samba
> cache_credentials = True
> id_provider = ad
> krb5_store_password_if_offline = True
> default_shell = /bin/bash
> ldap_id_mapping = True
> use_fully_qualified_names = True
> fallback_homedir = /home/%d/%u
> access_provider = ad
>
>
>
> Does sssd need to mount/access to the sysvol folder somehow ? Did I missed something
in the configuration of sssd ?
>
> Looking forward for some help ,thanks by advance.
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org