[SSSD-users] idmaping, nfs4krb, AD multi domain forest

Longina Przybyszewska longina at sdu.dk
Fri Jan 16 14:34:19 UTC 2015


Hi,
We have problems with authorization to the nfs mounted share with sec=krb5 in multi domain AD forest environment.

When server, client and user are from the same native domain, user’s  login,nfs+krb mount and access to nfs mounted share works fine.
server at nat.c.example.com
client at nat.c.example.com
user-n at nat.c.example.com

When user is from another domain, login(via ssh, GUI) and  nfs+krb mount works; User gets ‘Permission denied ‘ to the nfsshare for rw
server at nat.c.example.com
client at nat.c.example.com
user-a at adm.c.example.com

AD user test accounts (user-n, user-a) have Posix attributes ;
 AD groups for Posix enabled users have Posix gids;

Test users are members  of universal group usr-sdu-glu at c.example.com;

SSSD is configured identically on client and server:


[sssd]
domains = nat.c.example.com
config_file_version = 2
services = nss, pam

[pam]
pam_verbosity = 3
debug_level = 9

[domain/nat.c.example.com]

debug_level = 9
ad_domain = nat.c.example.com
ad_hostname = host.nat.c.example.com
krb5_realm = NAT.C.EXAMPLE.COM
#cache_credentials = True
id_provider = ad
access_provider = ad
chpass_provider = ad
auth_provider = ad
#
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
#use_fully_qualified_names = True
fallback_homedir = /home-local/%d/%u
ldap_user_principal = userPrincipalName

------
On client machine , in the “Permission denied” session, all AD groups, ids are shown correctly using id, getent ;

Obviousely configuring nfs idmaping  requires special attention in multi domain trust ( doesn’t seem trivial using UMICH method!).
May be some other AD specifics should be considered as well .

In the SSSD documentation is mentioned PAC service.
Here come my questions:

Do we need PAC service enabled to get properly resolved AD groups in Kerberos context  between domains?

IS it possible in the 1.11.7 version and with  (kernel 3.13.0-44) to  integrate  SSSD plugin  nfsidmap_sss.so introduced first in 1.12.1?

Best,
Longina


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20150116/c69e18da/attachment-0001.html>


More information about the sssd-users mailing list