We found out it has to do with GPO. With
ad_gpo_access_control = enforcing
we get failures (system error 4 with no indication in the logs it was GPO in any way).
ad_gpo_access_control = permissive
and all is well. I’ll open a ticket with Canonical.
From: Andreas Hasenack [mailto:andreas@canonical.com]
Sent: Monday, December 18, 2017 2:48 PM
To: End-user discussions about the System Security Services Daemon
<sssd-users(a)lists.fedorahosted.org>
Subject: [SSSD-users] Re: Ubuntu Xenial failures
EXTERNAL MAIL:
sssd-users-bounces@lists.fedorahosted.org<mailto:sssd-users-bounces@lists.fedorahosted.org>
You should file a bug in Ubuntu, specially if downgrading to the previous package fixes
the problem for you.
On Dec 18, 2017 18:10, "Jay McCanta"
<J.McCanta@f5.com<mailto:J.McCanta@f5.com>> wrote:
After an update to Ubuntu Xenial, sssd_pam always fails with a system error(4) error.
Dec 18 20:07:22 sv5cismfgcr01 sshd[27263]: pam_sss(sshd:auth): authentication success;
logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.11.129 user=mccanta
Dec 18 20:07:22 sv5cismfgcr01 sshd[27263]: pam_sss(sshd:account): Access denied for user
mccanta: 4 (System error)
I have debug_level 10 logs I can send. Didn't want to post thos to the mailing
list.
Jay
_______________________________________________
sssd-users mailing list --
sssd-users@lists.fedorahosted.org<mailto:sssd-users@lists.fedorahosted.org>
To unsubscribe send an email to
sssd-users-leave@lists.fedorahosted.org<mailto:sssd-users-leave@lists.fedorahosted.org>