[SSSD-users] Connection to ad via ldap failing

Jakub Hrozek jhrozek at redhat.com
Wed Jan 29 17:33:18 UTC 2014


On Wed, Jan 29, 2014 at 05:28:10PM +0000, Nordgren, Bryce L -FS wrote:
> 
> 
> > -----Original Message-----
> > On Tue, Jan 28, 2014 at 11:07:03PM +0000, Nordgren, Bryce L -FS wrote:
> 
> > I think the most important log would be the one from the back end,
> > generated by including debug_level in the [domain] section.
> 
> Ok. Will try it.
> 
> > Any reason why you set the principal to cn and not userPrincipalName ?
> 
> My userPrincipalName is set to <lotsanumbers>@FEDIDCARD.GOV whereas my Kerberos principal is bnordgren at DS.FS.FED.US. I suspect this has something to do with two factor authentication.

In case DS.FS.FED.US is the correct Kerberos realm, then I'd suggest to
set the principal to an attribute that doesn't exist. Then the SSSD will
try to 'guess' the principal as $username@$realm


More information about the sssd-users mailing list