We've been using SSSD with our AD domain (please forgive the domain
name...) with the following config on Ubuntu 16.04 for a year or so, with
no problems at all. Joined to the domain with realmd.
[sssd]
config_file_version = 2
reconnection_retries = 3
services = nss,pam
domains = SMALLBUSINESS.LAN
[nss]
[pam]
[domain/SMALLBUSINESS.LAN]
access_provider = ad
ad_domain = SMALLBUSINESS.LAN
ad_gpo_access_control = permissive
cache_credentials = True
default_shell = /bin/bash
fallback_homedir = /home/%u
id_provider = ad
krb5_realm = SMALLBUSINESS.LAN
krb5_store_password_if_offline = True
ldap_id_mapping = True
realmd_tags = manages-system joined-with-samba
However recently we've had a lot of problems with people being unable to
login when not connected to the network. This is with the handful of Ubuntu
17.04 machines I've started to roll out (SSSD 1.15.2 rather than 1.13.4 on
16.04).
After spending about a day reading up and trying every configuration under
the sun, I've found that the password doesn't appear to be cached on the
17.04 machine. If I run "ldbsearch -H
/var/lib/sss/db/cache_SMALLBUSINESS.LAN.ldb
"(&(objectClass=user)(cachedPassword=*))" name gidNumber
cachedPassword" on
my machine I get no results, but I get results on the working 16.04 machine.
I'm at my wits' end with this, so any suggestions you've got will be much
appreciated!
Many Thanks
Sam
--
*Laminar Data - Secure cloud-based platform for managing, sharing and
monetizing aeronautical data*
*Learn More <
https://laminardata.aero>*