4:17 a.m.
Hi,
I'm trying to authenticate Active Directory users with different UPN
suffixes on my Linux machine.
As described in article (http://jhrozek.livejournal.com/3019.html) SSSD
should support for enterprise logins:
"some users in AD might use a different Kerberos Principal suffix than the
default one".
I have two users with different UPN - user1(a)domain.example.com and
user2(a)department.example.com
#getent passwd user1(a)domain.example.com
returns valid user entry, but
#getent passwd user2(a)department.example.com
returns nothing...
What's wrong? Can anyone help me with this issue? Thanks!
Target system:
Red Hat Enterprise Linux Server release 7.0 (Maipo)
host1.domain.example.com 3.10.0-123.13.2.el7.x86_64 x86_64 x86_64 x86_64
GNU/Linux
sssd-1.11.2-68.el7_0.6.x86_64
---------------------------------------------------------------
Active Directory Domain:
schema: 2008 R2
tld: domain.example.com
---------------------------------------------------------------
Linux machine joined AD using command:
#adcli join domain.example.com -U admin -S dc1.domain.example.com -H
host1.domain.example.com -v -W
---------------------------------------------------------------
sssd.conf:
[sssd]
config_file_version = 2
services = nss, pam
domains = DOMAIN.EXAMPLE.COM
[nss]
[pam]
[domain/DOMAIN.EXAMPLE.COM]
debug_level = 10
id_provider = ad
auth_provider = ad
chpass_provider = ad
access_provider = ad
ad_domain = domain.example.com
ad_server = dc1.domain.example.com,10.0.0.2
ad_hostname = host1.domain.example.com
ldap_id_mapping = false
ldap_schema = rfc2307
krb5_use_enterprise_principal = true
enumerate = false
entry_cache_timeout = 60
fallback_homedir = /home/org/users/%u
shell_fallback = /bin/false
dyndns_update = true
---------------------------------------------------------------
krb5.conf:
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_realm = DOMAIN.EXAMPLE.COM
default_ccache_name = KEYRING:persistent:%{uid}
dns_lookup_kdc = false
[realms]
DOMAIN.EXAMPLE.COM = {
kdc = dc1.domain.example.com
kdc = 10.0.0.2
admin_server = dc1.domain.example.com
admin_server = 10.0.0.2
default_domain = domain.example.com
}
[domain_realm]
.domain.example.com = DOMAIN.EXAMPLE.COM
domain.example.com = DOMAIN.EXAMPLE.COM
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
---------------------------------------------------------------
sssd_DOMAIN.EXAMPLE.COM.log:
[sbus_dispatch] (0x4000): dbus conn: 0x7f75d0504770
[sbus_dispatch] (0x4000): Dispatching.
[sbus_message_handler] (0x4000): Received SBUS method [ping]
[sbus_dispatch] (0x4000): dbus conn: 0x7f75d0519b20
[sbus_dispatch] (0x4000): Dispatching.
[sbus_message_handler] (0x4000): Received SBUS method [getDomains]
[be_get_subdomains] (0x0400): Got get subdomains
[forced][department.example.com]
[be_queue_request] (0x4000): Queue is empty, running request immediately.
[be_queue_request] (0x4000): Adding request to queue.
[sdap_id_op_connect_step] (0x4000): reusing cached connection
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[objectclass=domain][DC=domain,DC=example,DC=com].
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSID]
[sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 11
[sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1],
ops[0x7f75d052de50], ldap[0x7f75d0521980]
[sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
[sdap_parse_entry] (0x4000): OriginalDN: [DC=domain,DC=example,DC=com].
[sdap_parse_range] (0x2000): No sub-attributes for [objectSid]
[sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1],
ops[0x7f75d052de50], ldap[0x7f75d0521980]
[sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg
set
[ad_master_domain_next_done] (0x0400): Found SID
[S-1-5-21-1505972566-2156897661-2636268315].
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(DnsDomain=domain.example.com)(NtVer=\14\00\00\00))][].
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [netlogon]
[sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 12
[sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1],
ops[0x7f75d0530150], ldap[0x7f75d0521980]
[sdap_process_result] (0x2000): Trace: ldap_result found nothing!
[sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1],
ops[0x7f75d0530150], ldap[0x7f75d0521980]
[sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
[sdap_parse_entry] (0x4000): OriginalDN: [].
[sdap_parse_range] (0x2000): No sub-attributes for [netlogon]
[sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1],
ops[0x7f75d0530150], ldap[0x7f75d0521980]
[sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg
set
[ad_master_domain_netlogon_done] (0x0400): Found flat name [DOMAIN].
[ad_master_domain_netlogon_done] (0x0400): Found forest
[domain.example.com].
[ad_subdomains_master_dom_done] (0x0400): Connected to forest root,
looking up child domains..
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(objectclass=trustedDomain)(trustType=2)(!(msDS-TrustForestTrustInfo=*)))][DC=domain,DC=example,DC=com].
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [flatName]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [trustPartner]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[securityIdentifier]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [trustType]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [trustAttributes]
[sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 13
[sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1],
ops[0x7f75d052e870], ldap[0x7f75d0521980]
[sdap_process_result] (0x2000): Trace: ldap_result found nothing!
[sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1],
ops[0x7f75d052e870], ldap[0x7f75d0521980]
[sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE]
[sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1],
ops[0x7f75d052e870], ldap[0x7f75d0521980]
[sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE]
[sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1],
ops[0x7f75d052e870], ldap[0x7f75d0521980]
[sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE]
[sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1],
ops[0x7f75d052e870], ldap[0x7f75d0521980]
[sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg
set
[sdap_id_op_done] (0x4000): releasing operation connection
[ad_subdomains_get_slave_domain_done] (0x1000): There are no changes
[get_subdomains_callback] (0x0400): Backend returned: (0, 0, <NULL>)
[Success]
[be_queue_next_request] (0x4000): Request queue is empty.
[sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1],
ops[(nil)], ldap[0x7f75d0521980]
[sdap_process_result] (0x2000): Trace: ldap_result found nothing!
[be_ptask_execute] (0x0400): Task [Cleanup of DOMAIN.EXAMPLE.COM]:
executing task, timeout 10800 seconds
---------------------------------------------------------------
--
With best regards, Eugene JONIK Peregudov
mailto: eugene.peregudov(a)gmail.com