Hello Spike.
Sorry that I cannot answer your question directly.
I would be interested though:
Using ldapsearch, I was able to verify that machine account didn’t
have the necessary privileges to query a user’s tokengroups.
Which search query did you use and which privilege does the account need to use
tokengroups?
I am also trying to use tokengroups, and may have the same problem.
________________________________
From: Spike White <spikewhitetx(a)gmail.com>
Sent: 01 July 2018 22:25:26
To: End-user discussions about the System Security Services Daemon
Subject: [SSSD-users] Why is my sssd deployment not doing cross-subdomain AD
authentication?
sssd subject matter experts,
Why is my sssd deployment not doing cross-subdomain AD authentication?
Background:
I have a parent AD domain
DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=http%3A%...
with trusted subdomains
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
APAC.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
EMEA.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
and
JAPN.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
Each subdomain has a transitive trust with
DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=http%3A%...;.
So all subdomains trust each other.
I set up a first test VM deployment using sssd. I set up the cross subdomain auth as in:
https://lists.fedorahosted.org/pipermail/sssd-users/2015-February/002648....
It worked great – allowed cross subdomain authentication. The only thing it would not do
was use tokengroups. That is, the VM was fully functional, but I had to add
‘ldap_use_tokengroups = false’ to the sssd.conf file.
My AD experts have advised me that ‘tokengroups’ are an important AD optimization and I
should use them, if at all possible.
Using ldapsearch, I was able to verify that machine account didn’t have the necessary
privileges to query a user’s tokengroups. Thus, the fault was mine – that this first sssd
deployment couldn’t use tokengroups.
So I did another sssd deployment, using another test VM. Apparently, I did the realm join
command correct this time, as it’s able to use tokengroups.
BUT! This second test VM is not allowing cross subdomain authentication and login. How
do I fix this so that I have use of both tokengroups and cross subdomain authentication?
(BTW -- Both test VMs are still up and operational, as described above.)
Details:
Here is the realm join command used in the second test VM (spikerealmd02):
kinit serviceunixinstall
realm join -v --automatic-id-mapping=no
--computer-ou='OU=Servers,OU=UNIX,DC=AMER,DC=DELL,DC=COM'
--user-principal="host/`hostname
--fqdn`@AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2FAMER.DELL.COM&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=DBeeCJIp7zh0a5l8YzMMjAU2WWA2kavAB1sZ3RtrP9c%3D&reserved=0>"
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
Here is the /etc/realmd.conf file from this second test VM:
[root@spikerealmd02 etc]# cat realmd.conf
[
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...]
computer-ou = OU=SERVERS,OU=UNIX,DC=AMER,DC=DELL,DC=COM
automatic-id-mapping = no
manage-system = no
fully-qualified-names = no
# THIS FAILS AT DELL; serviceunixinstall apparently not allowed to create UPNs associated
with machine account.
# Set the user-prinicpal to yes to create userPrincipalName attributes for the computer
account in the realm, in the form host/computer@REALM
#user-principal = yes
[active-directory]
default_client = sssd
[service]
automatic-install = no
[users]
# shouldn't need this; should be set in AD for each UNIX-enabled user.
default-home = /home/%U
# shouldn't need this; should be set in AD for each UNIX-enabled user.
default-shell = /bin/bash
Here’s the /etc/sssd/sssd.conf file for this second test VM:
[root@spikerealmd02 sssd]# cat sssd.conf
[sssd]
debug_level = 6
domains =
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
domain_resolution_order =
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
emea.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
japn.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
config_file_version = 2
services = nss,pam
#ldap_user_member_of = member
[pam]
pam_verbosity = 3
debug_level = 9
[nss]
debug_level = 9
filter_groups = root
filter_users = root
reconnection_retries = 3
#entry_cache_timeout = 300
entry_cache_nowait_percentage = 75
[
domain/amer.dell.com<https://emea01.safelinks.protection.outlook.com/?...]
debug_level = 9
auto_private_groups = True
use_fully_qualified_names = False
ad_domain =
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
krb5_realm =
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
realmd_tags = joined-with-adcli
cache_credentials = True
id_provider = ad
auth_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
fallback_homedir = /home/%u
access_provider = simple
#access_provider = ad
ldap_schema = rfc2307bis
ldap_sasl_authid =
host/spikerealmd02.us.dell.com@AMER.DELL.COM<mailto:spikerealmd02.us.dell.com@AMER.DELL.COM>
#ldap_sasl_authid =
SPIKEREALMD02$@AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2FAMER.DELL.COM&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=DBeeCJIp7zh0a5l8YzMMjAU2WWA2kavAB1sZ3RtrP9c%3D&reserved=0>
#ldap_sasl_authid = spikerealmd02@AMER.DELL.COM<mailto:spikerealmd02@AMER.DELL.COM>
ad_enabled_domains =
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
dyndns_update = False
subdomains_provider = none
ldap_use_tokengroups = true
simple_allow_groups = amerlinuxsup@AMER.DELL.COM<mailto:amerlinuxsup@AMER.DELL.COM>,
amerlinuxeng@AMER.DELL.COM<mailto:amerlinuxeng@AMER.DELL.COM>,
emealinuxsup@EMEA.DELL.COM<mailto:emealinuxsup@EMEA.DELL.COM>,
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
emealinuxeng@EMEA.DELL.COM<mailto:emealinuxeng@EMEA.DELL.COM>,
apaclinuxsup@EMEA.DELL.COM<mailto:apaclinuxsup@EMEA.DELL.COM>,
apaclinuxeng@EMEA.DELL.COM<mailto:apaclinuxeng@EMEA.DELL.COM>
# also look at
https://lists.fedorahosted.org/pipermail/sssd-users/2015-February/002648....
[
domain/apac.dell.com<https://emea01.safelinks.protection.outlook.com/?...]
debug_level = 9
auto_private_groups = True
use_fully_qualified_names = False
ad_domain =
apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
krb5_realm =
APAC.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
cache_credentials = True
id_provider = ad
auth_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
fallback_homedir = /home/%u
access_provider = simple
ldap_schema = rfc2307bis
ldap_sasl_authid =
host/spikerealmd02.us.dell.com@AMER.DELL.COM<mailto:spikerealmd02.us.dell.com@AMER.DELL.COM>
#ldap_sasl_authid =
SPIKEREALMD02$@AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2FAMER.DELL.COM&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=DBeeCJIp7zh0a5l8YzMMjAU2WWA2kavAB1sZ3RtrP9c%3D&reserved=0>
#ldap_sasl_authid = spikerealmd02@AMER.DELL.COM<mailto:spikerealmd02@AMER.DELL.COM>
ad_enabled_domains =
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
japn.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
dell.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%...
dyndns_update = False
subdomains_provider = none
ldap_use_tokengroups = false
simple_allow_groups = apaclinuxsup@APAC.DELL.COM<mailto:apaclinuxsup@APAC.DELL.COM>,
apaclinuxeng@APAC.DELL.COM<mailto:apaclinuxeng@APAC.DELL.COM>
[
domain/emea.dell.com<https://emea01.safelinks.protection.outlook.com/?...]
debug_level = 9
auto_private_groups = True
use_fully_qualified_names = False
ad_domain =
emea.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
krb5_realm =
EMEA.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
cache_credentials = True
id_provider = ad
auth_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
fallback_homedir = /home/%u
access_provider = simple
ldap_schema = rfc2307bis
ldap_sasl_authid =
host/spikerealmd02.us.dell.com@AMER.DELL.COM<mailto:spikerealmd02.us.dell.com@AMER.DELL.COM>
#ldap_sasl_authid =
SPIKEREALMD02$@AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2FAMER.DELL.COM&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=DBeeCJIp7zh0a5l8YzMMjAU2WWA2kavAB1sZ3RtrP9c%3D&reserved=0>
#ldap_sasl_authid = spikerealmd02@AMER.DELL.COM<mailto:spikerealmd02@AMER.DELL.COM>
ad_enabled_domains =
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
emea.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
japn.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
dell.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%...
dyndns_update = False
subdomains_provider = none
ldap_use_tokengroups = true
simple_allow_groups = emealinuxsup@EMEA.DELL.COM<mailto:emealinuxsup@EMEA.DELL.COM>,
emealinuxeng@EMEA.DELL.COM<mailto:emealinuxeng@EMEA.DELL.COM>
[
domain/japn.dell.com<https://emea01.safelinks.protection.outlook.com/?...]
debug_level = 9
auto_private_groups = True
use_fully_qualified_names = False
ad_domain =
japn.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
krb5_realm =
JAPN.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
cache_credentials = True
id_provider = ad
auth_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
fallback_homedir = /home/%u
access_provider = simple
ldap_schema = rfc2307bis
ldap_sasl_authid =
host/spikerealmd02.us.dell.com@AMER.DELL.COM<mailto:spikerealmd02.us.dell.com@AMER.DELL.COM>
#ldap_sasl_authid =
SPIKEREALMD02$@AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2FAMER.DELL.COM&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=DBeeCJIp7zh0a5l8YzMMjAU2WWA2kavAB1sZ3RtrP9c%3D&reserved=0>
#ldap_sasl_authid = spikerealmd02@AMER.DELL.COM<mailto:spikerealmd02@AMER.DELL.COM>
ad_enabled_domains =
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
japn.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
japn.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
dell.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%...
dyndns_update = False
subdomains_provider = none
ldap_use_tokengroups = true
simple_allow_groups = japnlinuxsup@JAPN.DELL.COM<mailto:japnlinuxsup@JAPN.DELL.COM>,
japnlinuxeng@JAPN.DELL.COM<mailto:japnlinuxeng@JAPN.DELL.COM>
and here’s the /etc/krb5.conf file:
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
# SW mod 5/12/2018
# dns_lookup_realm = false
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
# default_realm =
EXAMPLE.COM<https://emea01.safelinks.protection.outlook.com/?url=http%...
default_ccache_name = KEYRING:persistent:%{uid}
default_realm =
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
[realms]
#
EXAMPLE.COM<https://emea01.safelinks.protection.outlook.com/?url=http%...
= {
# kdc =
kerberos.example.com<https://emea01.safelinks.protection.outlook.com/?...
# admin_server =
kerberos.example.com<https://emea01.safelinks.protection.outlook.com/?...
# }
#
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
= {
# }
[domain_realm]
#
.example.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fexample.com&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=OpTGAjaRheIVNjj6q9B%2F25Vx66A%2FUuDse6N%2BDTA2xvw%3D&reserved=0>
=
EXAMPLE.COM<https://emea01.safelinks.protection.outlook.com/?url=http%...
#
example.com<https://emea01.safelinks.protection.outlook.com/?url=http%...
=
EXAMPLE.COM<https://emea01.safelinks.protection.outlook.com/?url=http%...
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
=
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
.amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Famer.dell.com&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=CNz3WvJmaG9Nu4O3CY4fakRChgeE4dMIAErMolrchN0%3D&reserved=0>
=
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
Comparing with first VM that does cross subdomain auth:
Here’s /etc/realmd.conf of first test VM that does cross subdomain auth (spikerealmd01):
[root@spikerealmd01 krb5.include.d]# cat /etc/realmd.conf
[
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...]
computer-ou = OU=SERVERS,OU=UNIX,DC=AMER,DC=DELL,DC=COM
automatic-id-mapping = no
manage-system = no
fully-qualified-names = no
# THIS FAILS AT DELL; serviceunixinstall apparently not allowed to create UPNs associated
with machine account.
# Set the user-prinicpal to yes to create userPrincipalName attributes for the computer
account in the realm, in the form host/computer@REALM
#user-principal = yes
[active-directory]
default_client = sssd
[service]
automatic-install = no
[users]
# shouldn't need this; should be set in AD for each UNIX-enabled user.
default-home = /home/%U
# shouldn't need this; should be set in AD for each UNIX-enabled user.
default-shell = /bin/bash
Here’s /etc/sssd/sssd.conf file from same first test VM:
[root@spikerealmd01 sssd]# cat sssd.conf
[sssd]
debug_level = 6
domains =
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
emea.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
japn.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
domain_resolution_order =
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
emea.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
japn.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
config_file_version = 2
services = nss, pam
#ldap_user_member_of = member
[pam]
pam_verbosity = 3
debug_level = 9
[nss]
debug_level = 9
filter_groups = root
filter_users = root
reconnection_retries = 3
#entry_cache_timeout = 300
entry_cache_nowait_percentage = 75
[
domain/amer.dell.com<https://emea01.safelinks.protection.outlook.com/?...]
debug_level = 9
auto_private_groups = True
use_fully_qualified_names = False
ad_domain =
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
krb5_realm =
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
realmd_tags = joined-with-adcli
cache_credentials = True
id_provider = ad
auth_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
fallback_homedir = /home/%u
access_provider = simple
ldap_schema = rfc2307bis
#ldap_sasl_authid =
host/spikerealmd01.us.dell.com<https://emea01.safelinks.protection.out...
#ldap_sasl_authid =
SPIKEREALMD01$@AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2FAMER.DELL.COM&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=DBeeCJIp7zh0a5l8YzMMjAU2WWA2kavAB1sZ3RtrP9c%3D&reserved=0>
ldap_sasl_authid = spikerealmd01@AMER.DELL.COM<mailto:spikerealmd01@AMER.DELL.COM>
ad_enabled_domains =
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
emea.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
japn.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
dell.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%...
dyndns_update = False
subdomains_provider = none
ldap_use_tokengroups = false
simple_allow_groups = amerlinuxsup@AMER.DELL.COM<mailto:amerlinuxsup@AMER.DELL.COM>,
amerlinuxeng@AMER.DELL.COM<mailto:amerlinuxeng@AMER.DELL.COM>
# also look at
https://lists.fedorahosted.org/pipermail/sssd-users/2015-February/002648....
[
domain/apac.dell.com<https://emea01.safelinks.protection.outlook.com/?...]
debug_level = 9
auto_private_groups = True
use_fully_qualified_names = False
ad_domain =
apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
krb5_realm =
APAC.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
realmd_tags = joined-with-adcli
cache_credentials = True
id_provider = ad
auth_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
fallback_homedir = /home/%u
access_provider = simple
ldap_schema = rfc2307bis
#ldap_sasl_authid =
host/spikerealmd01.us.dell.com<https://emea01.safelinks.protection.out...
#ldap_sasl_authid =
SPIKEREALMD01$@AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2FAMER.DELL.COM&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=DBeeCJIp7zh0a5l8YzMMjAU2WWA2kavAB1sZ3RtrP9c%3D&reserved=0>
ldap_sasl_authid = spikerealmd01@AMER.DELL.COM<mailto:spikerealmd01@AMER.DELL.COM>
ad_enabled_domains =
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
emea.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
japn.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
dell.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%...
dyndns_update = False
subdomains_provider = none
ldap_use_tokengroups = false
simple_allow_groups = apaclinuxsup@APAC.DELL.COM<mailto:apaclinuxsup@APAC.DELL.COM>,
apaclinuxeng@APAC.DELL.COM<mailto:apaclinuxeng@APAC.DELL.COM>
[
domain/emea.dell.com<https://emea01.safelinks.protection.outlook.com/?...]
debug_level = 9
auto_private_groups = True
use_fully_qualified_names = False
ad_domain =
emea.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
krb5_realm =
EMEA.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
realmd_tags = joined-with-adcli
cache_credentials = True
id_provider = ad
auth_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
fallback_homedir = /home/%u
access_provider = simple
ldap_schema = rfc2307bis
#ldap_sasl_authid =
host/spikerealmd01.us.dell.com<https://emea01.safelinks.protection.out...
#ldap_sasl_authid =
SPIKEREALMD01$@AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2FAMER.DELL.COM&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=DBeeCJIp7zh0a5l8YzMMjAU2WWA2kavAB1sZ3RtrP9c%3D&reserved=0>
ldap_sasl_authid = spikerealmd01@AMER.DELL.COM<mailto:spikerealmd01@AMER.DELL.COM>
ad_enabled_domains =
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
emea.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
japn.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
dell.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%...
dyndns_update = False
subdomains_provider = none
ldap_use_tokengroups = false
simple_allow_groups = emealinuxsup@EMEA.DELL.COM<mailto:emealinuxsup@EMEA.DELL.COM>,
emealinuxeng@EMEA.DELL.COM<mailto:emealinuxeng@EMEA.DELL.COM>
[
domain/japn.dell.com<https://emea01.safelinks.protection.outlook.com/?...]
debug_level = 9
auto_private_groups = True
use_fully_qualified_names = False
ad_domain =
japn.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
krb5_realm =
JAPN.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
realmd_tags = joined-with-adcli
cache_credentials = True
id_provider = ad
auth_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
fallback_homedir = /home/%u
access_provider = simple
ldap_schema = rfc2307bis
#ldap_sasl_authid =
host/spikerealmd01.us.dell.com<https://emea01.safelinks.protection.out...
#ldap_sasl_authid =
SPIKEREALMD01$@AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2FAMER.DELL.COM&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=DBeeCJIp7zh0a5l8YzMMjAU2WWA2kavAB1sZ3RtrP9c%3D&reserved=0>
ldap_sasl_authid = spikerealmd01@AMER.DELL.COM<mailto:spikerealmd01@AMER.DELL.COM>
ad_enabled_domains =
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
emea.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
japn.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...;,
dell.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%...
dyndns_update = False
subdomains_provider = none
ldap_use_tokengroups = false
simple_allow_groups = japnlinuxsup@JAPN.DELL.COM<mailto:japnlinuxsup@JAPN.DELL.COM>,
japnlinuxeng@JAPN.DELL.COM<mailto:japnlinuxeng@JAPN.DELL.COM>,
linux-core-engineering,
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
Here’s /etc/krb5.conf file:
[root@spikerealmd01 etc]# cat krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
# SW mod 5/12/2018
# dns_lookup_realm = false
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
# default_realm =
EXAMPLE.COM<https://emea01.safelinks.protection.outlook.com/?url=http%...
default_ccache_name = KEYRING:persistent:%{uid}
default_realm =
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
[realms]
#
EXAMPLE.COM<https://emea01.safelinks.protection.outlook.com/?url=http%...
= {
# kdc =
kerberos.example.com<https://emea01.safelinks.protection.outlook.com/?...
# admin_server =
kerberos.example.com<https://emea01.safelinks.protection.outlook.com/?...
# }
#
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
= {
# }
[domain_realm]
#
.example.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fexample.com&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=OpTGAjaRheIVNjj6q9B%2F25Vx66A%2FUuDse6N%2BDTA2xvw%3D&reserved=0>
=
EXAMPLE.COM<https://emea01.safelinks.protection.outlook.com/?url=http%...
#
example.com<https://emea01.safelinks.protection.outlook.com/?url=http%...
=
EXAMPLE.COM<https://emea01.safelinks.protection.outlook.com/?url=http%...
amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=htt...
=
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
.amer.dell.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Famer.dell.com&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=CNz3WvJmaG9Nu4O3CY4fakRChgeE4dMIAErMolrchN0%3D&reserved=0>
=
AMER.DELL.COM<https://emea01.safelinks.protection.outlook.com/?url=htt...
[root@spikerealmd01 etc]#
Other details:
If I query group membership of an engineer in APAC:
id admjesse_chan
on the good VM (spikerealmd01) I see all expected groups and I see this in the
/var/log/sssd/sssd_apac.dell.com.log file:
…
(Sun Jul 1 15:14:30 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[sdap_initgr_rfc2307bis_next_base] (0x0400): Searching for parent groups for user
[CN=AdmJesse_Chan,OU=ADMAccounts,DC=apac,DC=dell,DC=com] with base
[DC=apac,DC=dell,DC=com]
(Sun Jul 1 15:14:30 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(member=CN=AdmJesse_Chan,OU=ADMAccounts,DC=apac,DC=dell,DC=com)(objectClass=group)(sAMAccountName=*))][DC=apac,DC=dell,DC=com].
(Sun Jul 1 15:14:31 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[sdap_initgr_rfc2307bis_process] (0x1000): Found 4 parent groups for user
[AdmJesse_Chan@apac.dell.com<mailto:AdmJesse_Chan@apac.dell.com>]
(Sun Jul 1 15:14:31 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[sysdb_get_direct_parents] (0x2000): searching sysdb with filter
[(&(objectCategory=group)(member=name=AdmJesse_Chan@apac.dell.com<mailto:AdmJesse_Chan@apac.dell.com>,cn=users,cn=apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fapac.dell.com&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=4KAxxKaXc5lCpbwtzakV%2BJCVd%2Bej6MmS5RT0oWoh%2FZo%3D&reserved=0>,cn=sysdb))]
(Sun Jul 1 15:14:31 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[sysdb_get_direct_parents] (0x1000):
AdmJesse_Chan@apac.dell.com<mailto:AdmJesse_Chan@apac.dell.com> is a member of 4
sysdb groups
(Sun Jul 1 15:14:31 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[save_rfc2307bis_user_memberships] (0x2000): Updating memberships for
AdmJesse_Chan@apac.dell.com<mailto:AdmJesse_Chan@apac.dell.com>
(Sun Jul 1 15:14:31 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[sysdb_set_entry_attr] (0x0200): Entry
[name=AdmJesse_Chan@apac.dell.com<mailto:AdmJesse_Chan@apac.dell.com>,cn=users,cn=apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fapac.dell.com&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=4KAxxKaXc5lCpbwtzakV%2BJCVd%2Bej6MmS5RT0oWoh%2FZo%3D&reserved=0>,cn=sysdb]
has set [ts_cache] attrs.
(Sun Jul 1 15:14:31 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[dp_table_value_destructor] (0x0400): Removing
[0:1:0x0001:3::apac.dell.com:name=admjesse_chan@apac.dell.com<mailto:admjesse_chan@apac.dell.com>]
from reply table
(Sun Jul 1 15:14:35 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[sdap_asq_search_parse_entry] (0x2000): Matched objectclass [user] on DN
[CN=AdmJesse_Chan,OU=ADMAccounts,DC=apac,DC=dell,DC=com], will use associated map
(Sun Jul 1 15:14:35 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[sdap_parse_entry] (0x1000): OriginalDN:
[CN=AdmJesse_Chan,OU=ADMAccounts,DC=apac,DC=dell,DC=com].
(Sun Jul 1 15:14:35 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[sdap_asq_search_parse_entry] (0x2000): DN
[CN=AdmJesse_Chan,OU=ADMAccounts,DC=apac,DC=dell,DC=com] did not match the objectClass
[group]
(Sun Jul 1 15:14:36 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[sdap_nested_group_hash_insert] (0x4000): Inserting
[CN=AdmJesse_Chan,OU=ADMAccounts,DC=apac,DC=dell,DC=com] into hash table [users]
(Sun Jul 1 15:14:37 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[sdap_get_primary_name] (0x0400): Processing object AdmJesse_Chan
(Sun Jul 1 15:14:37 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[sysdb_cache_search_users] (0x2000): Search users with filter:
(&(objectCategory=user)(originalDN=CN=AdmJesse_Chan,OU=ADMAccounts,DC=apac,DC=dell,DC=com))
(Sun Jul 1 15:14:37 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[sdap_find_entry_by_origDN] (0x4000): Searching cache for
[CN=AdmJesse_Chan,OU=ADMAccounts,DC=apac,DC=dell,DC=com].
(Sun Jul 1 15:14:37 2018)
[
sssd[be[apac.dell.com<https://emea01.safelinks.protection.outlook.com/...]
[sdap_fill_memberships] (0x1000): member #2019 (CN=AdmJesse_Cha
,OU=ADMAccounts,DC=apac,DC=dell,DC=com):
[name=AdmJesse_Chan@apac.dell.com<mailto:AdmJesse_Chan@apac.dell.com>,cn=users,cn=apac.dell.com<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fapac.dell.com&data=01%7C01%7Cjohe%40novozymes.com%7Cebda1b26b8cf4378310108d5df90da3b%7C43d5f49ee03a4d22a2285684196bb001%7C0&sdata=4KAxxKaXc5lCpbwtzakV%2BJCVd%2Bej6MmS5RT0oWoh%2FZo%3D&reserved=0>,cn=sysdb]
If I do the same query on the bad VM (spikerealmd02):
[root@spikerealmd02 sssd]# id admjesse_chan
id: admjesse_chan: no such user
and I see nothing in the sssd_apac.dell.com.log file:
[root@spikerealmd02 sssd]# grep -i admjesse_chan sssd_apac.dell.com.log
[root@spikerealmd02 sssd]#
Please help,
Spike