On (05/05/15 12:16), Simon wrote:
Hi,
I have configured an Ubuntu 14.04 server to authenticate against, and use
attributes from, Active Directory running on Server 2008 R2.
However, I have a seemingly odd issue whereby user environment variables
(which are initially set correctly) get lost on the second (or third) and
then subsequent logins E.g.
First login:
Creating directory '/Users/domainuser'.
domainuser@localhost:~$ pwd
/Users/domainuser
domainuser@localhost:~$ echo $HOME
/Users/domainuser
domainuser@localhost:~$ getent passwd domainuser
domainuser:*:4000:3000:DomainUser:/Users/domainuser:/bin/bash
domainuser@localhost:~$ exit
Second (or third) login:
$ pwd
/
$ echo $HOME
/
$ getent passwd domainuser
domainuser:*:4000:3000:DomainUser:/:
For some reasons homeDirectory attribute was changes.
It's diffucult to say why.
You can inspect sssd cache with command line utility ldbsearch (in package
ldb-tools)
If the problem is just homedir then you can override value from LDAP/AD
with configuration options (override_homedir, *_homedir).
You can find more details in man page sssd.conf.
sssd.conf looks like this:
[sssd]
debug_level = 1
domains =
example.com
config_file_version = 2
services = nss, pam, sudo
[nss]
filter_groups = root,localadmin
filter_users = root,localadmin
[
domain/example.com]
# General Options
debug_level = 1
id_provider = ad
access_provider = ad
use_fully_qualified_names = false
cache_credentials = true
case_sensitive = false
# SSS-AD Options
ad_domain =
example.com
# SSSD-KRB5 Options
krb5_realm =
EXAMPLE.COM
realmd_tags = manages-system joined-with-samba
# SSSD-LDAP Options
ldap_schema = AD
ldap_id_mapping = false
ldap_idmap_range_min = 1000
ldap_idmap_range_max = 2145326679
ldap_search_base = dc=example,dc=com
ldap_group_search_base =
OU=Groups,DC=example,DC=com???CN=Users,DC=example,DC=com??
ldap_user_search_base = OU=Accounts,DC=example,DC=com
ldap_group_object_class = group
ldap_user_object_class = person
ldap_group_modify_timestamp = whenChanged
ldap_user_modify_timestamp = whenChanged
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = sAMAccountName
ldap_user_name = sAMAccountName
If anyone thinks they can shed any light on the matter I'd be most grateful.
I would recommend to increase debug_level to 3 in domain, nss and pam section.
Reproduce and try to find errors in sssd log files or in /var/log/secure.log
It can be good beginning.
Please try to also read
https://fedorahosted.org/sssd/wiki/Troubleshooting
LS