[SSSD-users] sssd, Ubuntu 14.04, can't see users in trusted domains within same forest

[Jeff Silverman]

Hi! Please help. Everything I've read has stated that this should work, but it does
not. On ubuntu, that is. I set up a Centos 7 box and this *did* work. I've tried this
on

* Ubuntu 14.04 with sssd 1.11.8 (from the default Ubuntu 14.04 repos) -- didn't work
* Ubuntu 14.04 with sssd 1.13.4 (from a PPA) -- also didn't work
* Centos 7 with sssd 1.14.0 -- This worked!
* Ubuntu 16.04 with sssd 1.13.4 -- this did not work

*Description*

I have two Active Directory domains in the same forest.
  * Domain "CORP"
  * Domain "QA"

I have 2-way trusts set up between the domains.

"Real users" are all in CORP

Authorization into QA is handled with AD Universal Groups, but I don't think
that's relevant here (especially since what I want to work does work on Centos
7+sssd)

I have an Ubuntu 14.04 box set up which I joined to domain "QA" via realmd.
here's the actual command I used

realm join \
    --install=/ \
    --verbose \
    --user=jsilverman(a)CORP.EXAMPLE.COM \
    --client-software=sssd \
    --membership-software=adcli \
    --computer-ou="OU=Linux,OU=Servers,DC=qa,DC=example,DC=com" \
    QA.EXAMPLE.COM


Running this command, realmd 
* creates a kerberos keytab
* sets up sssd.conf
* adds the computer to the OU specified in QA.EXAMPLE.COM

I then went in and added another domain to sssd.conf to configure CORP. When done, I have
the following config files:

** File /etc/sssd.conf **:

[sssd]
domains = qa.example.com
config_file_version = 2
services = nss, pam

[domain/qa.example.com]
ad_domain = qa.example.com
krb5_realm = QA.EXAMPLE.COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /srv/home/%u
access_provider = ad
enumerate = True

[domain/corp.example.com]
ad_domain = corp.example.com
krb5_realm = CORP.EXAMPLE.COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /srv/home/%u
access_provider = ad
enumerate = True


** File /etc/krb5.conf **:

[libdefaults]
    default_realm = QA.EXAMPLE.COM

[realms]
QA.EXAMPLE.COM = {
    kdc = qadc01a.example.com
    kdc = qadc01b.example.com
    admin_server = qadc01a.example.com
}
CORP.EXAMPLE.COM = {
    kdc = corpdc01a.it.example.com
    kdc = corpdc01b.it.example.com
    admin_server = corpdc01a.it.example.com
}


[domain_realm]
.qa.example.com = QA.EXAMPLE.COM
qa.example.com = QA.EXAMPLE.COM
.corp.example.com = CORP.EXAMPLE.COM
corp.example.com = CORP.EXAMPLE.COM

** File /etc/realmd.conf **:
[service]
automatic-install = no

[users]
default-home = /srv/home/%U
default-shell = /bin/bash

[qa.example.com]
computer-ou = OU=Servers,OU=Linux,DC=qa,DC=example,DC=com
automatic-id-mapping = yes
fully-qualified-names = no

[corp.example.com]
automatic-id-mapping = yes
fully-qualified-names = no

Finally, when I do all this on Centos 7, I am able to find users in both domains, and
I'm able to authenticate as those users from both domains. Example , *on Centos 7*:

# getent passwd  jsilverman(a)corp.example.com
[e-mail]:*:363201124:363201124:Jeff
Silverman:/srv/home/jsilverman:/bin/bash
# getent passwd qatestadmin
qatestadmin:*:277401105:277400513:QA Test Admin:/srv/home/qatestadmin:/bin/bash
# getent passwd qatestadmin(a)qa.example.com
qatestadmin:*:277401105:277400513:QA Test Admin:/srv/home/qatestadmin:/bin/bash


HOWEVER, when I do all this on Ubuntu 14.04, OR on Ubuntu 16.04, I can only see users from
the QA domain.

# getent passwd  jsilverman(a)corp.example.com    ## (Note: there is no output from this
command)
# getent passwd qatestadmin
qatestadmin:*:277401105:277400513:QA Test Admin:/srv/home/qatestadmin:/bin/bash
# getent passwd qatestadmin(a)qa.example.com
qatestadmin:*:277401105:277400513:QA Test Admin:/srv/home/qatestadmin:/bin/bash


Please advise!