<div dir="ltr">I'm having trouble authenticating to an AD domain with a disjointed namespace using SSSD. Here's what I'm up against:<div><br></div><div>netbios domain name: BLAH</div><div>domain (& kerberos realm): <a href="http://DS.BLAH.COM">DS.BLAH.COM</a></div>
<div>UPNs: <a href="mailto:username@BLAH.COM">username@BLAH.COM</a></div><div><br></div><div>to join to the domain I have to have workgroup: BLAH in smb.conf, which is not generally how smb and winbind are config'ed (usually it would be DS instead of BLAH).</div>
<div>I can create a kerberos ticket for <a href="mailto:user@DS.BLAH.COM">user@DS.BLAH.COM</a>.</div><div>I can do an "id <a href="mailto:user@ds.blah.com">user@ds.blah.com</a>" and get valid response.</div><div>
but when I try to "su <a href="mailto:user@ds.blah.com">user@ds.blah.com</a>" I get an invalid password, and a log entry indicating "[sssd[krb5_child[29198]]]: Cannot resolve servers for KDC in realm "<a href="http://BLAH.COM">BLAH.COM</a>"". I'm assuming that it's looking for the KDC there because of the setting in smb.conf.<br>
</div><div><br></div><div>I'm running SSSD 1.9.2 on CentOS 6.5.</div><div><br></div><div>I've tried various settings googling around, and so my current sssd.conf file looks like:</div><div><br></div><div><div>[sssd]</div>
<div>services = nss, pam, ssh, pac</div><div>config_file_version = 2</div><div><br></div><div>domains = <a href="http://ds.blah.com">ds.blah.com</a></div><div><br></div><div>debug_level = 10</div><div>[nss]<br></div><div>
<br></div><div>[pam]</div><div><br></div><div>[sudo]</div><div><br></div><div>[autofs]</div><div><br></div><div>[ssh]</div><div><br></div><div>[pac]</div><div><br></div><div>[domain/<a href="http://ds.blah.com">ds.blah.com</a>]</div>
<div>cache_credentials = False</div><div>krb5_store_password_if_offline = False</div><div>id_provider = ad</div><div>auth_provider = ad</div><div>access_provider = ad</div><div>ad_server = <a href="http://dc1.ds.blah.com">dc1.ds.blah.com</a></div>
<div>ad_hostname = <a href="http://host.ds.blah.com">host.ds.blah.com</a></div><div>krb5_realm = <a href="http://DS.BLAH.COM">DS.BLAH.COM</a><br></div><div>ad_domain = <a href="http://ds.blah.com">ds.blah.com</a></div><div>
ad_enable_dns_sites = True</div><div>krb5_canonicalize = false</div><div><br></div><div>debug_level = 5</div><div><br></div></div><div><br></div><div>Any suggestions would be greatly appreciated.</div><div><br></div><div>
<div><div><div dir="ltr">===================================<br><div style="margin-left:40px"><b style="font-family:arial,helvetica,sans-serif">Daniel Shown,</b><br style="font-family:arial,helvetica,sans-serif">Linux Systems Administrator<br style="font-family:arial,helvetica,sans-serif">
<span style="font-family:arial,helvetica,sans-serif">Advanced Technology Group</span><br style="font-family:arial,helvetica,sans-serif"><a style="font-family:arial,helvetica,sans-serif" href="http://www.slu.edu/its" target="_blank">Information Technology Services</a><br style="font-family:arial,helvetica,sans-serif">
<span style="font-family:arial,helvetica,sans-serif">at </span><a style="font-family:arial,helvetica,sans-serif" href="http://www.slu.edu/" target="_blank">Saint Louis University</a><span style="font-family:arial,helvetica,sans-serif">.</span><br style="font-family:arial,helvetica,sans-serif">
<br style="font-family:arial,helvetica,sans-serif"><a style="font-family:arial,helvetica,sans-serif">314-977-2583</a><br></div>===================================<br><br><div style="margin-left:40px">"The aim of education <br>
is the knowledge, <br>not of facts, <br>but of values." <br>— William S. Burroughs<br><br>"I’m supposed to be </div><div style="margin-left:40px">a scientific person </div><div style="margin-left:40px">but I use intuition </div>
<div style="margin-left:40px">more than logic </div><div style="margin-left:40px">in making basic </div><div style="margin-left:40px">decisions."</div><div style="margin-left:40px">— Seymour R. Cray</div><div style="margin-left:40px">
<br></div><img style="background-color: rgb(51, 51, 153);" src="https://sites.google.com/a/slu.edu/slu-its-101/_/rsrc/1303829218862/config/customLogo.gif?revision=2" height="21" width="420"><br></div></div>
</div></div></div>