[SSSD-users] override upn
Longina Przybyszewska
longina at sdu.dk
Fri Mar 15 11:29:16 UTC 2013
Hi,
This is sssd-1.9.4 Ubuntu 12.10;
id_provider = ad
auth_provider = krb5
Users in domain c.my.domain with userPrincipalName=name at student.my.domain, can not login to the computer.
The computer has joined AD in yet another domain 'nat.c.my.domain'
All user information can be retrieved from AD, from that computer, at
least with commands:
ldapsearch (as user, after kinit user_name at c.my.domain),
or as root on that computer:
id name at student.my.domain
id name at c.my.domain
id name
>From krb5_child.log I can see that Kerberos refuses to issue TGT, as
search is done for non existing realm
name at STUDENT.MY.DOMAIN
Apparently, domain part in upn is treated as krb realm.
I have mapped student.my.domain domain to C.MY.DOMAIN realm in
/etc/krb5.conf
[domain_realm]
...
student.my.domain = C.MY.DOMAIN
....
and
in sssd.conf I have configured domain pointing to C.MY.DOMAIN realm.
[domain/student.my.domain]
....
krb5_realm = C.MY.DOMAIN
....
Is there any way to configure sssd to fix it?
Longina
--
Longina Przybyszewska
IT-Service,
University of Southern Denmark,
Campusvej 55,
DK-5230 Odense M, Denmark
Phone Direct: +45 6550 2359
--
More information about the sssd-users
mailing list