[SSSD] Access denied by pam_sss(sshd:account)

Dmitri Pal dpal at redhat.com
Fri Jun 28 14:39:28 UTC 2013


>> Also in 1.10 SSSD should support transitive trusts so if there is a
>> trust between the domains SSSD 1.10 should be able to authenticate users
>> from both domains.
> You can use the TGT to access both trusted domains in a trust, but the
> TGT must be obtained from the KDC you are enrolled with. At least
> with AD, because there are no krb5-master SRV records by default on the
> AD side, so the libkrb5 has no means of asking who to contact to if the
> keytab is not local to the domain. One could work around by adding the
> SRV records or adding the master_kdc option to krb5.conf, but the AD
> provider only talks to the local KDC when acquiring a TGT by default.
>
> I learned this the hard way when debugging the trusts in the AD provider
> recently :)
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

Are you saying that if there are two domins A & B user is from A and
system is from B and user logs into the system using his user name and
password (not SSH with GSSAPI) he needs to have additional DNS records?
My understanding (may be limited) of the flow would be that when you try
to authenticate the request would go to domain B, it will recognize that
the user is from trusted domain and issue a cross realm ticket to the
client and redirect it to domain A. Is this the place where the client
should be able to resolve the domain A? Would adding local records or
records into AD DNS solve the problem? Is this what you are suggesting
above?

-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/






More information about the sssd-devel mailing list