[SSSD-users] override upn
Sumit Bose
sbose at redhat.com
Fri Mar 15 12:53:51 UTC 2013
On Fri, Mar 15, 2013 at 12:29:16PM +0100, Longina Przybyszewska wrote:
> Hi,
> This is sssd-1.9.4 Ubuntu 12.10;
> id_provider = ad
> auth_provider = krb5
>
> Users in domain c.my.domain with userPrincipalName=name at student.my.domain, can not login to the computer.
>
> The computer has joined AD in yet another domain 'nat.c.my.domain'
>
> All user information can be retrieved from AD, from that computer,
> at least with commands:
> ldapsearch (as user, after kinit user_name at c.my.domain),
>
> or as root on that computer:
>
> id name at student.my.domain
> id name at c.my.domain
> id name
>
> From krb5_child.log I can see that Kerberos refuses to issue TGT, as
> search is done for non existing realm
> name at STUDENT.MY.DOMAIN
>
> Apparently, domain part in upn is treated as krb realm.
>
> I have mapped student.my.domain domain to C.MY.DOMAIN realm in
> /etc/krb5.conf
> [domain_realm]
> ...
> student.my.domain = C.MY.DOMAIN
> ....
This won't work here, because this entries are used to find a realm for
a fully qualified host name.
If the realm STUDENT.MY.DOMAIN is handled by AD you can add a
STUDENT.MY.DOMAIN = {
...
}
section to the [realms] section in /etc/krb5.conf pointing to the AD
server.
>
> and
> in sssd.conf I have configured domain pointing to C.MY.DOMAIN realm.
>
> [domain/student.my.domain]
> ....
> krb5_realm = C.MY.DOMAIN
The attribute read from LDAP will always be preferred. As a workaround
you can add
ldap_user_principal = some_non_existing_attribute_name
As a result sssd is not able to read the principal from LDAP and will
construct one with the user name and the realm given in krb5_realm.
HTH
bye,
Sumit
> ....
>
> Is there any way to configure sssd to fix it?
>
> Longina
>
>
> --
> Longina Przybyszewska
> IT-Service,
> University of Southern Denmark,
> Campusvej 55,
> DK-5230 Odense M, Denmark
> Phone Direct: +45 6550 2359
> --
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
More information about the sssd-users
mailing list