On Wed, Apr 10, 2013 at 01:04:03PM -0400, Sutton, Harry (GSSE) wrote:
On 04/10/2013 11:12 AM, Stephen Gallagher wrote:
>>You can change the domain delimiter in SSSD with the
>>re_expression option in the [sssd] section. By default it assumes
>>"user@DOMAIN", but you can swap it out for something else. See the
>>sssd.conf(5) manpage and search on 're_expression'.
Okay, I think I still have the problem, in that the delimiter in
both instances is the '@' sign. Even when I manually specify the
domain portion (e.g., "re_expression =
(?P<name>[^@]+)(a)AMERICAS.CPQCORP.NET") it continues to flag [Cannot
resolve servers for KDC in realm "HP.COM"] in /var/log/secure. And
although ldap_child.log references the correct domain (via the
keytab file), krb5_child.log continues to show "Attempting kinit for
I guess it is related to the content of the userPrincipalName in AD. The
@HP.COM will be listed here. SSSD prefers the content of this attribute
to generating the Kerberos principal based on the user and the realm
name. But with AD it is a bit more difficult because the names listed in
the attribute can have suffixes which are different from the Kerberos
realm, making it difficult for the Linux client to find the right KDC.
As a short cut you can just set
ldap_user_principal = SomeAttributeNameThatDoesNotExists
in the domain section of sssd.conf. Then sssd cannot find a Kerberos
principal on the server and build one based on the name and the realm.
To be on the safe side you can add krb5_realm = AMERICAS.CPQCORP.NET
sssd.conf (if you not already have it).
The correct solution is https://fedorahosted.org/sssd/ticket/1842
I'm current running some final tests before I send the patch to
sssd-devel. So hopefully in the next sssd release you do not need the
fix mentioned above.
I'm probably either missing the point of your suggestion, Stephen,
or (just as likely) exposing my limited knowledge of regular
sssd-users mailing list