So I think the problem is persisting. I managed to make work samba 4 as a DC with full
replication.
When starting sssd even the dns update is working against samba 4 bind_dlz backend.
However the GPO are still skipped.
Regarding the configuration, I changed it a bit :
[sssd]
domains =
mydc.com
config_file_version = 2
services = nss, pam
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
[pam]
reconnection_retries = 3
[
domain/mydc.com]
debug_level = 10
ldap_schema = ad
ad_domain =
mydc.com
dyndns_server =
dc01.mydc.com
ad_server =
dc01.unity3d.com
krb5_realm =
UNITY3D.COM
ad_gpo_access_control = enforcing
ad_gpo_map_service = +openvpn
#krb5_use_enterprise_principal = false
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
fallback_homedir = /home/%u@%d
access_provider = ad
By specifying AD for ldap_scheme (as I use samba4 sernet), now I can found my users
correctly using POSIX. I also manage by setting "us_fully_quilifield_names" to
False to get a proper list of the groups for a users or when checking with "id"
command.example :
[user3@gtwdcsmb ~]$ id
uid=15001(user3) gid=10000(domain users) groups=10000(domain users),10004(not_allow)
[user3@gtwdcsmb ~]$
Here is the Debug as requested, you will also fin the log associated. I recreated them
before doing the dbg
dbg as requested :
http://pastebin.com/usijYbFE
log associated :
[root@gtwdcsmb sssd]# ls -ltr
total 492
-rw------- 1 root root 15766 Apr 24 11:27 ldap_child.log
-rw------- 1 root root 15015 Apr 24 11:27 krb5_child.log
-rw------- 1 root root 0 Apr 24 11:27 gpo_child.log
-rw------- 1 root root 128 Apr 24 11:29 sssd.log
-rw------- 1 root root 826 Apr 24 11:32 sssd_pam.log
-rw------- 1 root root 826 Apr 24 11:32 sssd_nss.log
-rw------- 1 root root 255234 Apr 24 11:33 sssd_mydc.com.log
ldap_child.log :
http://pastebin.com/3qk2RPma
krb5_child.log :
http://pastebin.com/5GDskCJN
gpo_child.log : empty
sssd_mydc.com.log :
http://pastebin.com/4yHUXRZ3
Here is the version that I use :
The VM with SSSD :
[root@gtwdcsmb sssd]# uname -a
Linux
gtwdcsmb.unity3d.com 3.10.0-327.13.1.el7.x86_64 #1 SMP Thu Mar 31 16:04:38 UTC 2016
x86_64 x86_64 x86_64 GNU/Linux
[root@gtwdcsmb sssd]# cat /etc/redhat-release
CentOS Linux release 7.2.1511 (Core)
[root@gtwdcsmb sssd]# rpm -qa | grep sssd
sssd-client-1.13.0-40.el7_2.2.x86_64
sssd-common-pac-1.13.0-40.el7_2.2.x86_64
sssd-krb5-1.13.0-40.el7_2.2.x86_64
python-sssdconfig-1.13.0-40.el7_2.2.noarch
sssd-krb5-common-1.13.0-40.el7_2.2.x86_64
sssd-ipa-1.13.0-40.el7_2.2.x86_64
sssd-ldap-1.13.0-40.el7_2.2.x86_64
sssd-proxy-1.13.0-40.el7_2.2.x86_64
sssd-common-1.13.0-40.el7_2.2.x86_64
sssd-ad-1.13.0-40.el7_2.2.x86_64
sssd-1.13.0-40.el7_2.2.x86_64
sssd-debuginfo-1.13.0-40.el7_2.2.x86_64
The VM with Samba:
root@dc01:~# cat /etc/debian_version
8.4
root@dc01:~# uname -a
Linux dc01 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt25-2 (2016-04-08) x86_64 GNU/Linux
root@dc01:~# dpkg -l |grep samba
ii libwbclient0:amd64 99:4.3.8-11 amd64 Glue package
for sernet-samba-libs.
ii samba-common 99:4.3.8-11 all Glue package
for sernet-samba-common.
rc samba-libs:amd64 2:4.2.10+dfsg-0+deb8u2 amd64 Samba core
libraries
ii sernet-samba 99:4.3.8-11 amd64 SMB/CIFS
file, print, and login server for Unix
ii sernet-samba-ad 99:4.3.8-11 amd64 Samba Active
Directory Domain Controller
ii sernet-samba-client 99:4.3.8-11 amd64 a
LanManager-like simple client for Unix
ii sernet-samba-common 99:4.3.8-11 all Samba common
files used by both the server and the client
ii sernet-samba-libs:amd64 99:4.3.8-11 amd64 Samba common
library files used by both the server and the client
ii sernet-samba-libsmbclient0:amd64 99:4.3.8-11 amd64 Shared
library that allows applications to talk to SMB servers
ii sernet-samba-winbind 99:4.3.8-11 amd64 Samba
nameservice integration server
Thanks you again for your help . :D