sssd-users February 2019

sssd-users@lists.fedorahosted.org

15 participants
22 discussions

No netgroup_provider?
by Spike White 18 Feb '19

18 Feb '19

All, Spoiler alert: my configuration is working; I just want verification I did it right. BACKGROUND: I have an LDAP domain that was delivering autofs maps exclusively. Other (AD) domains were delivering users, groups, authentication and access. Since this back-end LDAP domain didn’t participate in any user authentication or access, I configured that backup LDAP domain in sssd.conf with only an autofs_provder: [domain/LDAP] debug_level = 9 id_provider = none autofs_provider = ldap ldap_uri= ldap://austgcore17.example.com ldap_schema = rfc2307bis ldap_default_bind_dn = cn=ldapadm,dc=itzgeek,dc=local ldap_default_authtok = ldppassword ldap_autofs_search_base = ou=automount,ou=admin,dc=itzgeek,dc=local ldap_autofs_map_object_class = automountMap ldap_autofs_map_name = automountMapName ldap_autofs_entry_object_class = automount ldap_autofs_entry_key = automountKey ldap_autofs_entry_value = automountInformation ldap_netgroup_search_base = ou=netgroup,ou=admin,dc=itzgeek,dc=local Works great! Get all expected automount maps. CURRENT (ADDED NETGROUPS): Now I have added NIS netgroups to this backend LDAP server. Thus, it now successfully delivers automount maps + netgroups. I still don’t want this LDAP backend domain to even attempt authentication and access – that’s in my other (AD) domains. So you’d think all I’d have to do is change this: [domain/LDAP] … id_provider = none autofs_provider = ldap to this: [domain/LDAP] … id_provider = none autofs_provider = ldap netgroup_provider = ldap But – point in fact – there is no “netgroup_provider” setting for sssd.conf file. Netgroup takes whatever the value is of ‘id_provider’. So I turned on id_provider, then explicitly turned off all providers I don’t want. Is this correct? [domain/LDAP] debug_level = 9 #id_provider = none id_provider = ldap auth_provider = none account_provider = none chpass_provider = none sudo_provider = none subdomains_provider = none autofs_provider = ldap Also, any particular reason there’s not a netgroup_provider? BTW, retrieving netgroups via sssd does not seem explicitly and concretely documented. That is, I had to consult multiple sources to get the RFC 2307bis setup, another to get the sssd.conf settings. (I’m not faulting anyone; netgroups are rarely used anymore.) Is there someone that maintains sssd documentation, I could submit a concrete example – to help any future intrepid explorer? I have the specific back-end LDIF files, the specific sssd.conf and nsswitch.conf file setup. Spike White

3 4

Any way to disallow unauthorized users in the pam "authentication" phase instead of "account" phase?
by Spike White 18 Feb '19

18 Feb '19

All, This is not a big deal -- just curious. We have a commercial Linux AD integration product. In it, the incoming user's authorization to log in is validated during the PAM "authentication" phase. So if it's a legal AD user and good password, but that user is not authorized in -- you're returned to the "login name: / password:" prompt. In sssd, it appears that validating if you're a legally-authorized user or in a legally-authorized group occurs in the PAM "account" phase. It's done by the "simple" access_provider. Consider again a legal AD user and good password, but again -- that user is not authorized in. Now that user name is accepted, that password is accepted, but then the server closes your putty session. You're not returned to a "login name: / password:" prompt. Like I say -- not a big deal. Unauthorized users are intercepted and disallowed, just in different ways. Just curious if there's a way to make sssd fail in the former manner, instead of the latter. Spike White

2 1

SSO works on one server but not the other (reinstall?)
by Hans Schou 15 Feb '19

15 Feb '19

Hi I have two servers "L" & "R" which are connected to the AD. On server L I can login with SSO and I don't have to type password. On server R I can't login with SSO and I have to type the AD password. The user is only defined in the AD not locally. I have tried "realm leave" + "realm join" and "sss_cache -E". Removed /etc/sssd/* /etc/krb5.keytab /var/lib/sss/db/* to make sure no config was leftover. The /etc/sssd/sssd.conf is equal on both servers. Both servers are running RHEL 7.6. /etc/sssd/sssd.conf : [sssd] domains = acme.com config_file_version = 2 services = nss, pam [domain/acme.com] ad_domain = acme.com krb5_realm = ACME.COM realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = False fallback_homedir = /home/%u access_provider = ad debug_level = 7 Any hint much appreciated. best regards Hans

2 2

smartcard cert mapping offline (AD)
by Winberg, Adam 13 Feb '19

13 Feb '19

I'm having a hard time understanding how cert mapping is supposed to work offline. Currently I have the following certmap config (this is on RHEL8-beta): [certmap/ad.example.com/smartcard] maprule = (|(userPrincipal={subject_principal})(samAccountName={subject_principal.short_name})) to map the CN on the card to 'samAccountName' in AD. This works as long as I'm online (access to AD), but when I go offline (disconnect network) the maprule is not working. I thought that the mapping would then use the sssd cache but apparantly not - so how is smartcard login supposed to work offline? Regards Adam

2 7

Cant get new TGT after kdestroy on gdm login with smartcard.
by Winberg, Adam 13 Feb '19

13 Feb '19

I am having problems consistently getting a TGT after logging in via GDM with smartcard. On first login it normally works, but if I do a 'kdestroy' and then logout of my gnome session, I don't get a new TGT when I login to a new session. Instead, the root user has a TGT for my AD user: [a001329@c20693 ~]$ klist klist: Credentials cache 'KCM:60483' not found [root@c20693 ~]# klist Ticket cache: KCM:0:63363 Default principal: a001329(a)EXAMPLE.COM Valid starting Expires Service principal 2019-02-13 15:11:38 2019-02-14 01:11:33 krbtgt/EXAMPLE.com(a)EXAMPLE.com renew until 2019-02-20 15:11:33 A wild guess is that krb5-pkinit works by letting the root user get a TGT for my user and then transfer that cache to my user, or something? In my case that transfer does not happen if I previously performed a kdestroy. From krb5_child.log: (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [sss_get_ccache_name_for_principal] (0x4000): Location: [KCM:] (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [sss_get_ccache_name_for_principal] (0x4000): tmp_ccname: [KCM:0:71555] (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache] (0x4000): Initializing ccache of type [KCM] (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache] (0x4000): CC supports switch (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache] (0x4000): returning: 0 (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [safe_remove_old_ccache_file] (0x0400): New and old ccache file are the same, none will be deleted. (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [k5c_send_data] (0x0200): Received error code 0 (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [pack_response_packet] (0x2000): response packet size: [95] (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [k5c_send_data] (0x4000): Response sent. (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [main] (0x0400): krb5_child completed successfully After a while (not sure how long) it works as expected again, presumably after a timeout of some sort. If I disable KCM (by removing /etc/krb5.conf.d/kcm_default_ccache) TGT retrieval works as expected. Am I missing something or is this a bug? Regards, Adam

2 1

Password expiration odd behavior with SUDO
by Gabe Pacuilla 11 Feb '19

11 Feb '19

Version: sssd-1.16.2-13.el7.x86_64 Hello All, I've been working with SSSD using FreeIPA directory services, and I've noticed this odd behavior when passwords expire and prompted to change on auth: --- ipa-user@host:~$ sudo su - [sudo] password for ipa-user: <Enter password> Password expired. Change your password now. sudo: Account or password is expired, reset your password and try again Current Password: <Hit Ctrl+C here> sudo: unable to change expired password: Authentication token manipulation error ipa-user@host:~$ ^C ipa-user@host:~$ ^C ipa-user@host:~$ ^C ipa-user@host:~$ sudo su - Last login: blah [root@host ~]# --- I don't believe we should be able to cancel out of expired password change and subsequently be able to authenticate without any prompt? It appears the sudo ticket is generated before the password expiration prompt is shown. This seems like breaking behavior since the password expiration is not really being enforced, and in our environment we'll only use passwords for sudo (ssh keys for remote login). For what it's worth, here's the contents of pam system-auth config: --- #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so --- Thanks in advance for any insight, -Gabe

1 0

AD 2016 integration GPO weirdness
by Emil Petersson 11 Feb '19

11 Feb '19

Hi, I am trying to configure Active Directory integration with SSSD. AD is running on 2016, and my clients are CentOS 7.6, running SSSD 1.16.2-13.el7. I want to control client access using AD GPO. The issue I'm seeing is that any user is allowed to log on to the client, regardless if they are allowed by a GPO or not. The clients were successfully joined to AD by running: realm join --user=username --computer-ou='OU=Linux,OU=Servers,OU=XXX,DC=XXX,DC=XXX,DC=net' xxx.xxx.net The client sssd.conf looks like this: [sssd] domains = xxx.xxx.net config_file_version = 2 services = nss, pam full_name_format = %1$s default_domain_suffix = xxx.xxx.net [domain/xxx.xxx.net] debug_level = 9 ad_domain = xxx.xxx.net krb5_realm = XXX.XXX.NET realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%u@%d access_provider = ad ad_gpo_access_control = enforcing dyndns_update = false When trying to log in with an unauthorized user, I get the following output from SSSD debug: [ad_gpo_perform_hbac_processing] (0x4000): allow_key: SeRemoteInteractiveLogonRight [ad_gpo_perform_hbac_processing] (0x4000): deny_key: SeDenyRemoteInteractiveLogonRight [parse_policy_setting_value] (0x0400): No value for key [SeRemoteInteractiveLogonRight] found in gpo result [ad_gpo_access_check] (0x0400): RESULTANT POLICY: [ad_gpo_access_check] (0x0400): gpo_map_type: Remote Interactive [ad_gpo_access_check] (0x0400): allowed_size = 0 [ad_gpo_access_check] (0x0400): denied_size = 3 [ad_gpo_access_check] (0x0400): denied_sids[0] = S-1-5-21-1107582786-1995068826-2594897426-4406 [ad_gpo_access_check] (0x0400): denied_sids[1] = S-1-5-21-1107582786-1995068826-2594897426-4281 [ad_gpo_access_check] (0x0400): denied_sids[2] = S-1-5-21-1107582786-1995068826-2594897426-4021 [ad_gpo_access_check] (0x0400): CURRENT USER: [ad_gpo_access_check] (0x0400): user_sid = S-1-5-21-1107582786-1995068826-2594897426-5609 [ad_gpo_access_check] (0x0400): group_sids[0] = S-1-5-21-1107582786-1995068826-2594897426-5611 [ad_gpo_access_check] (0x0400): group_sids[1] = S-1-5-21-1107582786-1995068826-2594897426-513 [ad_gpo_access_check] (0x0400): group_sids[2] = S-1-5-21-1107582786-1995068826-2594897426-5612 [ad_gpo_access_check] (0x0400): group_sids[3] = S-1-5-11 [ad_gpo_access_check] (0x0400): POLICY DECISION: [ad_gpo_access_check] (0x0400): access_granted = 1 [ad_gpo_access_check] (0x0400): access_denied = 0 [ad_gpo_access_done] (0x0400): GPO-based access control successful. I'm not understanding what's happening here. It's as if my test user is allowed by default. Could this be due to a PAM config? I was expecting to be denied login until I've explicitly setup a GPO to allow login :) Any help is much appreciated!

2 3

password not complex enough error for AD users
by robert wild 11 Feb '19

11 Feb '19

hi all, i have got sssd on a centos 7 vm and i have got it working https://www.linuxtechi.com/integrate-rhel7-centos7-windows-active-directory/ as when i do id AD_user it comes up with the uid, gid and all the group members that user belongs to also they can login on the logon page using there AD accounts but when they open up a terminal window i want it so they can change there passwords i have added to my "/etc/sssd/sssd.conf" file these two lines from this link https://linux.die.net/man/5/sssd.conf pwd_expiration_warning = 7 chpass_provider = ad but they get this error when they try to change there passwords [robert.wild@lon-p-xrdp01 ~]$ passwd Changing password for user robert.wild. Current Password: New password: Retype new password: Password change failed. Server message: Please make sure the password meets the complexity constraints. passwd: Authentication token manipulation error [robert.wild@lon-p-xrdp01 ~]$ but i know i do meet the password requirements as i have added 13 characters including upper/lower/numbers/special characters has anyone got sssd to change user passwords thanks, rob

3 7

AD multiple domains - login failed for child domain
by Jeremy Monnet 08 Feb '19

08 Feb '19

Hello, I never fixed issues I had last year https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… but I did made a new test on a brand new ubuntu up to date, and the result is far better, though everything is not working. As a reminder, I have an AD with a parent and a child domain, let's say example.com and child.example.com. For the new server I set up, I used system provided utilities realm join example.com -U 'user(a)EXAMPLE.COM' which pretty much generates root@ubuntu:/var/log/sssd# cat /etc/sssd/sssd.conf [sssd] domains = example.com config_file_version = 2 services = nss, pam [domain/example.com] ad_domain = example.com krb5_realm = EXAMPLE.COM realmd_tags = manages-system joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = False use_fully_qualified_names = False fallback_homedir = /home/%u@%d debug_level=9 access_provider = ad Now, everything is OK with the main domain, AFAIK, I can login, sudo based on groups, etc. But for the child domain, most work, I can id a user@child (that resolves the user and the groups associated), I can "su - user@child" from root, BUT I can not login with that user@child. Sanitized logs follow : sssd_example.com.log (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [get_server_status] (0x1000): Status of server '<ad>' is 'working' (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [get_port_status] (0x1000): Port status of port 389 for server '<ad>' is 'working' (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6 seconds (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [get_server_status] (0x1000): Status of server '<ad>' is 'working' (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [be_resolve_server_process] (0x0200): Found address for server <ad>: [IP] TTL 3600 (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://<ad>' (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://<ad>' (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/pubconf/.krb5info_dummy_ivIwhy] (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/pubconf/.krb5info_dummy_ivIwhy] (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [sss_domain_get_state] (0x1000): Domain child.example.com is Active (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [child_handler_setup] (0x2000): Setting up signal handler up for pid [30303] (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [child_handler_setup] (0x2000): Signal handler set up for pid [30303] (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [write_pipe_handler] (0x0400): All data has been sent! (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [read_pipe_handler] (0x0400): EOF received, client finished (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [krb5_auth_done] (0x0040): The krb5_child process returned an error. Please inspect the krb5_child.log file or the journal for more information krb5_child.log (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393070: Sending TCP request to stream <IP>:88 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393071: Received answer (317 bytes) from stream <IP>:88 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393072: Terminating TCP connection to stream <IP>:88 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393073: Response was from master KDC (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393074: Decoding FAST response (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393075: TGS request result: -1765328377/Server not found in Kerberos database (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393076: Requesting tickets for RestrictedKrbHost/ubuntu(a)EXAMPLE.COM, referrals off (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393077: Generated subkey for TGS request: rc4-hmac/1624 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393078: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393080: Encoding request body and padata into FAST request (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393081: Sending request (1719 bytes) to EXAMPLE.COM (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393082: Initiating TCP connection to stream <IP>:88 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393083: Sending TCP request to stream <IP>:88 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393084: Received answer (317 bytes) from stream <IP>:88 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393085: Terminating TCP connection to stream <IP>:88 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393086: Response was from master KDC (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393087: Decoding FAST response (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393088: TGS request result: -1765328377/Server not found in Kerberos database (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393089: Destroying ccache MEMORY:xwkvpg9 Do you have any idea why the server is not found in the child domain ? Could that be because the wrong server principal may be used ? Thanks for your help ! Jeremy

3 5

SSSD : id don't display groups name subdomain (Child trust)
by Martial CHAVIGNY 05 Feb '19

05 Feb '19

Hi everyone, In dev environnement, with SSSD 1.16.2 (release 13.el7_6.5) on RHEL 7.6 SSSD is configured to request on mch.dev domain. trusted subdomain sub.mch.dev exist (Win2k16) On mch.dev, I have an user 'user1' in Universal groups 'G_TEST' and 'allowed_ssh'. These groups are placed also in mch.dev domain. On sub.mch.dev, I have user 'user2' only. 'user2' is place in 'G_TEST' and 'allowed_ssh'. When get id user from mch.dev domain, by `id mch\user1` I get this result : `uid=83701115(user1) gid=513(sssdgrp) groups=513(sssdgrp),83701107(allowed_ssh),83701117(g_test)`, but `id sub\user2`, in same group (universal - child trust), I get `uid=69901104(user2) gid=69901104(user2) groups=69901104(user2)` without group name getent work fine : `getent group 'g_test'` result : `g_test:*:83701117:user2,user1,mch` Why I have not groupname for user2 ? sssd.conf : [sssd] domains = mch.dev config_file_version = 2 services = nss, pam default_domain_suffix = mch.dev full_name_format = %1$s [nss] filter_users = root reconnection_retries = 3 entry_cache_nowait_percentage = 75 [pam] pam_pwd_expiration_warning = 21 pam_account_expired_message = Account/password expired, please use selfservice portal to change your password and logon again. [domain/MCH.DEV] debug_level = 9 id_provider = ad access_provider = ad auth_provider = ad ad_domain = mch.dev krb5_realm = MCH.DEV krb5_store_password_if_offline = True cache_credentials = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True override_gid = 513 fallback_homedir = /home/%u@%d default_shell = /bin/bash dyndns_update = false ldap_idmap_range_min = 100000 ldap_use_tokengroups = False krb5.conf includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false default_ccache_name = KEYRING:persistent:%{uid} default_realm = MCH.DEV [realms] MCH.DEV = { } [domain_realm] mch.dev = MCH.DEV .mch.dev = MCH.DEV Logs available here: https://pastebin.com/Ntt62Cxt Thanks in advance @Jakub Hrozek jhrozek(a)redhat.com<mailto:jhrozek@redhat.com> With the configuration above, Inverse of your problem : I can't view and use group for sub domain user, but I can login with SSH like this : 'ssh -l 'sub\user2' 172.31.8.88'

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users February 2019