[SSSD-users] sssd not authentication with user in random groups

Jakub Hrozek jhrozek at redhat.com
Wed Feb 11 13:27:54 UTC 2015


On Wed, Feb 11, 2015 at 01:20:10PM +0000, Mullan, Allan wrote:
> Good afternoon,
> 
> I've been playing around with sssd for a while not and it's been great but I've just run into a really weird problem. If I have a user specified in the 'simple_allow_users' configuration directive it works absolutely fine BUT I've got (at least) 2 groups that, for some reason, if the user is a member of these groups the account can't authenticate on my boxes. The groups that I'm having problems with are nothing to do with any simple_allow_groups - they're just normal AD security groups...
> 
> Can someone please point me in the right direction on this one or let me know how I can best find out why these groups are affecting sssd? I've been trawling logs but can't seem to find anything obvious.
> 
> Thanks,
> Allan

Did you verify it's actually the pam account phase that's kicking you
out?

If yes, then increasing debug_level in the domain section is a good start.

Do the groups show up in the "id" output for the groups?


More information about the sssd-users mailing list