[Freeipa-users] ipa clients cannot ssh with AD credentials

[iulian roman]

I am using a Idm setup  which has AD trust configured.  

IPADEV.EXAMPLE.LOCAL is the IPA realm
EXAMPLE.LOCAL is the AD realm

I  can ssh to both ipa servers with AD credentials , but cannot ssh to the ipa  clients. I
have enabled debug for almost all services in sssd and the only one which seems to be
related to the issue is this one: 

[[sssd[krb5_child[29926]]]] [sss_child_krb5_trace_cb] (0x4000): [29926] 1619534544.375456:
Getting initial credentials for user.email\@COMPANY.COM(a)IPADEV.EXAMPLE.LOCAL 

[[sssd[krb5_child[29926]]]] [get_and_save_tgt] (0x0020): 1695: [-1765328378][Client
'[e-mail](a)IPADEV.EXAMPLE.LOCAL' not found in Kerberos database]

What i do not understand is why does it use UPN (in the user.email format)  to query for
the user . 

I can run id, getent passwd, etc and all userids/gids are resolved. 

I have tried many settings in sssd.conf , both on the client and server side, but none of
them helped. 

Bellow are the sssd.conf and krb5.conf from the client:

sssd.conf
========
[domain/ipadev.example.local]

cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = ipadev.example.local
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ldap_tls_cacert = /etc/ipa/ca.crt
ipa_hostname = ipadev02.example.local
chpass_provider = ipa
ipa_server = _srv_, ipadev04.example.local, ipadev05.example.local
#dns_discovery_domain = ipadev.example.local
debug_level = 9
krb5_auth_timeout = 30
[sssd]
domain_resolution_order = example.local, ipadev.example.local
services = nss, sudo, pam, ssh, ifp

domains = ipadev.example.local
debug_level = 9
[nss]
homedir_substring = /home

[pam]

[sudo]

[autofs]

[ssh]
debug_level = 9

[pac]

[ifp]

[secrets]

[session_recording]

krb5.conf
========
#File modified by ipa-client-install

includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/

[libdefaults]
  default_realm = IPADEV.EXAMPLE.LOCAL
  dns_lookup_realm = true
  dns_lookup_kdc = true
  rdns = false
  dns_canonicalize_hostname = false
  ticket_lifetime = 24h
  forwardable = true
  udp_preference_limit = 0
  default_ccache_name = KEYRING:persistent:%{uid}


[realms]
  IPADEV.EXAMPLE.LOCAL = {
    kdc = ipadev04.example.local:88
    master_kdc = ipadev04.example.local:88
    admin_server = ipadev04.example.local:749
    kpasswd_server = ipadev04.example.local:464
    kdc = ipadev05.example.local:88
    master_kdc = ipadev05.example.local:88
    admin_server = ipadev05.example.local:749
    kpasswd_server = ipadev05.example.local:464
    default_domain = ipadev.example.local
    pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
    pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem

  }


[domain_realm]
  .ipadev.example.local = IPADEV.EXAMPLE.LOCAL
  ipadev.example.local = IPADEV.EXAMPLE.LOCAL
  ipadev02.example.local = IPADEV.EXAMPLE.LOCAL
  .example.local = IPADEV.EXAMPLE.LOCAL
  example.local = IPADEV.EXAMPLE.LOCAL