Adding service to sssd + AD

[Maciej Piechotka]

I have following configuaration:

[sssd]
config_file_version = 2
domains = domain.com
services = nss, pam

[nss]

[pam]

[domain/domain.com]
cache_credentials = true
id_provider = ad
auth_provider = ad
access_provider = simple
default_shell = /bin/zsh
fallback_homedir = /home/%d/%u
use_fully_qualified_names = true
ldap_id_mapping = true
ldap_schema = ad
ldap_idmap_range_min = 100000
ldap_idmap_range_max = 2000100000
ldap_idmap_range_size = 200000000
ldap_idmap_default_domain = DOMAIN.COM
ignore_group_members = true

Ticket cache: FILE:/tmp/krb5cc_400389252_3sT5UifBXn
Default principal: username(a)DOMAIN.COM

Valid starting       Expires              Service principal
07/20/2016 12:18:01  07/20/2016 21:14:13  krbtgt/DOMAIN.COM(a)DOMAIN.COM
        renew until 07/27/2016 11:14:13

I got kerberos working and login through gssapi to ssh:

Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   2 host/hostname.domain.com(a)DOMAIN.COM
   2 host/hostname.domain.com(a)DOMAIN.COM
   2 host/hostname.domain.com(a)DOMAIN.COM
   2 host/hostname.domain.com(a)DOMAIN.COM
   2 host/hostname.domain.com(a)DOMAIN.COM
   2 host/hostname(a)DOMAIN.COM
   2 host/hostname(a)DOMAIN.COM
   2 host/hostname(a)DOMAIN.COM
   2 host/hostname(a)DOMAIN.COM
   2 host/hostname(a)DOMAIN.COM
   2 HOSTNAME$(a)DOMAIN.COM
   2 HOSTNAME$(a)DOMAIN.COM
   2 HOSTNAME$(a)DOMAIN.COM
   2 HOSTNAME$(a)DOMAIN.COM
   2 HOSTNAME$(a)DOMAIN.COM

However I cannot get OpenAFS to work. I suspect it is that I don't have
afs/hostname(a)DOMAIN.COM principal. How should I add service to keytab
(I don't have admin rights on KDC) with SSD + AD?

Maciej

[Ondrej Valousek]

Try "net ads keytab add afs" - but it's probably not going to work without
admin privileges in AD.
O.

-----Original Message-----
From: Maciej Piechotka [mailto:[e-mail]] 
Sent: Wednesday, July 20, 2016 9:30 PM
To: sssd-users(a)lists.fedorahosted.org
Subject: [SSSD-users] Adding service to sssd + AD

I have following configuaration:

[sssd]
config_file_version = 2
domains = domain.com
services = nss, pam

[nss]

[pam]

[domain/domain.com]
cache_credentials = true
id_provider = ad
auth_provider = ad
access_provider = simple
default_shell = /bin/zsh
fallback_homedir = /home/%d/%u
use_fully_qualified_names = true
ldap_id_mapping = true
ldap_schema = ad
ldap_idmap_range_min = 100000
ldap_idmap_range_max = 2000100000
ldap_idmap_range_size = 200000000
ldap_idmap_default_domain = DOMAIN.COM
ignore_group_members = true

Ticket cache: FILE:/tmp/krb5cc_400389252_3sT5UifBXn
Default principal: username(a)DOMAIN.COM

Valid starting       Expires              Service principal
07/20/2016 12:18:01  07/20/2016 21:14:13  krbtgt/DOMAIN.COM(a)DOMAIN.COM
        renew until 07/27/2016 11:14:13

I got kerberos working and login through gssapi to ssh:

Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   2 host/hostname.domain.com(a)DOMAIN.COM
   2 host/hostname.domain.com(a)DOMAIN.COM
   2 host/hostname.domain.com(a)DOMAIN.COM
   2 host/hostname.domain.com(a)DOMAIN.COM
   2 host/hostname.domain.com(a)DOMAIN.COM
   2 host/hostname(a)DOMAIN.COM
   2 host/hostname(a)DOMAIN.COM
   2 host/hostname(a)DOMAIN.COM
   2 host/hostname(a)DOMAIN.COM
   2 host/hostname(a)DOMAIN.COM
   2 HOSTNAME$(a)DOMAIN.COM
   2 HOSTNAME$(a)DOMAIN.COM
   2 HOSTNAME$(a)DOMAIN.COM
   2 HOSTNAME$(a)DOMAIN.COM
   2 HOSTNAME$(a)DOMAIN.COM

However I cannot get OpenAFS to work. I suspect it is that I don't have
afs/hostname(a)DOMAIN.COM principal. How should I add service to keytab (I don't have
admin rights on KDC) with SSD + AD?

Maciej
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/[e-mail]

-----

The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.

[John Hodrien]

On Thu, 21 Jul 2016, Ondrej Valousek wrote:

>  Try "net ads keytab add afs" - but it's probably not
> going to work without
>  admin privileges in AD. 
Domain Admin is *definitely* not required for this, but obviously you do need
a credential with sufficient rights.  The machine's credential itself is
probably sufficient.

jh

[Maciej Piechotka]

Ondrej Valousek <Ondrej.Valousek <at> s3group.com> writes:

>  
>  Try "net ads keytab add afs" - but it's probably not going to work without
admin privileges in AD.
>  O.
>   
Thanks. I've run:
% sudo net -U <ACCOUNT> ads keytab add afs
Processing principals to add...
% sudo net -U <ACCOUNT> ads keytab list | grep afs || echo "None found"
None found

<ACCOUNT> was account with sufficient priviliges to join domain.

[Maciej Piechotka]

Maciej Piechotka <uzytkownik2 <at> gmail.com> writes:

>  
>  Thanks. I've run:
>  % sudo net -U <ACCOUNT> ads keytab add afs
>  Processing principals to add...
>  % sudo net -U <ACCOUNT> ads keytab list | grep afs || echo "None found"
>  None found
>   
Never mind - it suddently started working today.