<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000066">
Ok, about which principal it is complaining?<br>
<br>
Beware of the fact that Linux Kerberos library is bit too picky
about DNS - so make sure that both forward and reverse lookups works
fine for your host and KDC. Ideally should Kerberos realm also match
your default DNS domain.<br>
<br>
Unfortunately I do not know the answer to your second problem.<br>
<br>
Ondrej<br>
<br>
On 03/21/2012 10:05 AM, R.L. wrote:
<blockquote
cite="mid:DF55618A-0BF1-4992-803B-3E23C72CFED2@gmail.com"
type="cite">
<div>Hello</div>
<div><br>
</div>
<div>Thanks. No, using msktutil. </div>
<div><br>
</div>
<div>The computer record in ad looks exactly equivalent to others
created manually using ktpass.exe. </div>
<div><br>
</div>
<div>r.<br>
<br>
<br>
</div>
<div><br>
On 21/03/2012, at 7:23 PM, Ondrej Valousek <<a
moz-do-not-send="true" href="mailto:webserv@s3group.cz">webserv@s3group.cz</a>>
wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<meta content="text/html; charset=UTF-8"
http-equiv="Content-Type">
How did you create the computer account in AD? Manually or
using Samba?<br>
Ondrej<br>
<br>
On 03/21/2012 07:05 AM, Rolf Loudon wrote:
<blockquote
cite="mid:5FF10C03-F11A-4C21-83C0-33A0EB7E3FD2@gmail.com"
type="cite">
<pre wrap="">Hello
I've installed sssd 1.5 on an ubuntu 11.10 server. I've followed the howto at
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://fedorahosted.org/sssd/wiki/Configuring%20sssd%20to%20authenticate%20with%20a%20Windows%202008%20Domain%20Server">https://fedorahosted.org/sssd/wiki/Configuring%20sssd%20to%20authenticate%20with%20a%20Windows%202008%20Domain%20Server</a>
I wish to use SASL as the authentication to the AD KDC. I add the computer account to the domain and test it as described with
kinit -k -t /etc/krb5.keytab <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:host/myhostname.domain.name@REALM.NAME">host/myhostname.domain.name@REALM.NAME</a>
then
ldapsearch -h ad.kdc -b "dc=domainpart1,dc=domainpart2,dc=domainpart3" -Y GSSAPI cn=someuser
and that all works fine.
When I use this setup within sssd there are a two main issues.
Firstly the logs tell me that the principal is not found in the KDC database. But when I inspect it using ADSI Edit I see the SPN and UPN values that I expect to see and that match the principal it says it cannot find. Likewise these principals can be seen from klist -kte /etc/krb5/keytab (though it doesn't complain about not finding anything in the key tab)
I can get round that issue temporarily by specifying the principal name using ldap_sasl_authid. I'd still like to know what is wrong in that instance.
Secondly the ldap_search_base strangely affects the authentication and the user lookup. I don't know if the searching is subtree or not. I can't see a parameter to make this explicit.
If I set ldap_search_base (or ldap_user_search_base) to dc=domainpart1,dc=domainpart2,dc=domainpart3 then I get errors about ldap_sasl_interactive_bind_s failing.
however if I set the ldap_search_base to cn=users,dc=domainpart1,dc=domainpart2,dc=domainpart3 then those errors go away and the lookup is done.
The problem is that the users do not live in cn=users,dc=domainpart1,dc=domainpart2,dc=domainpart3 they are in an OU elsewhere. They can be found via a subtree search (as per the ldapsearch example above) if the search base is set to higher up the tree at just the domain components specification.
But if I set the search base that way, then the sasl bind fails.
Using both ldap_search_base and ldap_user_search_base makes no difference.
Is there are way to separately define where the ldap_sasl_bind looks (unless I misunderstand it needs to look for the computer account, which is in cn=computers,dc=... which is also not within cn=users,dc=... so its still confusing me) so that the search base can be set so the user lookup will work.
I can successfully lookup the user if I use a simple bind with ldap_default_bind_dn and ldap_default_authtok rather than sasl. And can show that the ldap_search_base affects this lookup in the above way.
Really appreciate any pointers to these two problems.
many thanks
r.
_______________________________________________
sssd-devel mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://fedorahosted.org/mailman/listinfo/sssd-devel">https://fedorahosted.org/mailman/listinfo/sssd-devel</a>
</pre>
</blockquote>
<br>
</div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span>sssd-devel mailing list</span><br>
<span><a moz-do-not-send="true"
href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a></span><br>
<span><a moz-do-not-send="true"
href="https://fedorahosted.org/mailman/listinfo/sssd-devel">https://fedorahosted.org/mailman/listinfo/sssd-devel</a></span><br>
</div>
</blockquote>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
sssd-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/mailman/listinfo/sssd-devel">https://fedorahosted.org/mailman/listinfo/sssd-devel</a>
</pre>
</blockquote>
<br>
</body>
</html>