On Thu, Aug 11, 2016 at 05:47:33PM +0000, Thomas Beaudry wrote:
After playing around with my krb5.conf file i figured out that when
adding the following line:
[appdefaults]
do i get to join the realm. If not I get this error:
! Couldn't authenticate to active directory: SASL(-1): generic failure: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information (Server not found in
Kerberos database)
adcli: couldn't connect to concordia.ca domain: Couldn't authenticate to active
directory: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code
may provide more information (Server not found in Kerberos database)
! Insufficient permissions to join the domain
realm: Couldn't join realm: Insufficient permissions to join the domain
This is often caused by broken reverse DNS.
Maybe this is a bug? Anyways, how would this affect sssd letting me authenticate.
The issue is that sssd doesn't even get to the authentication step,
because it can't even access the AD DC to retrieve identity data.