I'm wondering what the heck I'm doing wrong. I'm working on getting SSSD + KRB5 working against 2008 R2 AD. It's working fine in RHEL5 w/ the standard LDAP.conf configuration. I'm working on sssd, but am not getting a binddn connection to AD. Here's my config: <br>
<br>grep -vE '^#|^$' /etc/sssd/sssd.conf <br>[sssd]<br>config_file_version = 2<br>reconnection_retries = 3<br>sbus_timeout = 30<br>services = nss, pam<br>domains = default<br>[nss]<br>filter_groups = root<br>filter_users = root<br>
reconnection_retries = 3<br>[pam]<br>reconnection_retries = 3<br>[domain/default]<br>description = LDAP domain with AD server<br>enumerate = false<br>id_provider = ldap<br>chpass_provider = krb5<br>ldap_uri = ldap://<a href="http://usherdc103.domain.com">usherdc103.domain.com</a> ldap://<a href="http://usherdc104.domain.com">usherdc104.domain.com</a><br>
ldap_search_base = DC=Domain,DC=com<br>ldap_tls_cacertdir = /etc/openldap/cacerts<br>ldap_default_bind_dn = <a href="mailto:ldapbinddn@DOMAIN.COM">ldapbinddn@DOMAIN.COM</a><br>ldap_default_authtok_type = password<br>ldap_default_authtok = YAYYOUGOTME<br>
ldap_pwd_policy = none<br>ldap_user_object_class = user<br>ldap_group_object_class = group<br>cache_credentials = True<br>krb5_realm = <a href="http://DOMAIN.COM">DOMAIN.COM</a><br>krb5_kdcip = <a href="http://usherdc103.domain.com">usherdc103.domain.com</a>,<a href="http://usherdc104.domain.com">usherdc104.domain.com</a><br>
krb5_chanegpw_principle = kadmin/changepw<br><br>wtf am I doing wrong, and is ldap for authentication better then krb5? or should I stick with ldap for authorization and krb5 for authentication? <br><br>Thank you. <br>