<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 6, 2014 at 12:42 PM, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank" onclick="window.open('https://mail.google.com/mail/?view=cm&tf=1&to=abokovoy@redhat.com&cc=&bcc=&su=&body=','_blank');return false;">abokovoy@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="im">On Thu, 06 Feb 2014, Steve Dainard wrote:<br>
</div><div class="im"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
In newer versions (FreeIPA 3.3+, SSSD 1.11+) this is done on IPA master<br>
automatically by setting ipa_master_mode = True<br>
<br>
On RHEL 6.x one needs to add the parameters manually.<br>
<br>
2. /etc/krb5.conf has to contain auth_to_local rules that map AD<br>
principals to lower-cased versions because some applications (SSH)<br>
are very picky about user/principal name mapping. This has to be done<br>
on both IPA masters and IPA clients.<br>
<br>
</blockquote>
<br>
This was done on the IPA server, but the RHEL 6.5 client doesn't have this<br>
file.<br>
<br>
On the IPA server:<br>
<br>
[realms]<br>
MIOLINUX.CORP = {<br>
kdc = ipa1.miolinux.corp:88<br>
master_kdc = ipa1.miolinux.corp:88<br>
admin_server = ipa1.miolinux.corp:749<br>
default_domain = miolinux.corp<br>
pkinit_anchors = FILE:/etc/ipa/ca.crt<br>
auth_to_local = RULE:[1:$1@$0](^.*@MIOVISION$)<u></u>s/@MIOVISION/@miovision/<br>
auth_to_local = DEFAULT<br>
<br>
[root@ipa1 ~]# kinit sdainard@miovision.corp<br>
Password for sdainard@miovision.corp:<br>
kinit: KDC reply did not match expectations while getting initial<br>
credentials<br>
</blockquote></div>
MIT Kerberos is case-sensitive for the realm, so it should always be <br>
kinit sdainard@MIOVISION.CORP<br>
<br>
make also sure that your rule above has proper realm. If your realm is<br>
MIOVISION.CORP, then auth_to_local rule is<br>
<br>
auth_to_local = RULE:[1:$1@$0](^.*@MIOVISION.<u></u>CORP$)s/@MIOVISION.CORP/@<u></u>miovision.corp/<br></blockquote><div><br></div><div>OK that makes sense. I wasn't sure if it was NETBIOS or not. Changed. </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
In MIT Kerberos 1.13 we'll have an interface that will allow SSSD to<br>
automatically generate (and supply) these rules. Prior to that we have<br>
to have explicit configuration on all clients and servers.</blockquote><div><br></div><div>Excellent, do you work with whomever is maintaining the Ubuntu PPA on this as well? One of our dev teams is exclusively on Ubuntu 12.04 and I've had some serious issues with the joining clients from distro. </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
A CentOS 6.5 client has this file. The docs didn't mention the manual<br>
client config, I just assumed the IPA server would proxy the request. After<br>
adding, no change.<br>
</blockquote></div>
A request to IPA server needs to come from a client and a client needs<br>
to know about that. We changed SSSD 1.11+ to discover IPA capabilities<br>
and self-configure but for older clients (1.9..1.10) you need to perform<br>
it through explicit config.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
With these changes SSSD on IPA client will recognize AD users and<br>
request IPA master to perform name/SID/etc resolution, and also will<br>
make an attempt to parse special part of the Kerberos ticket<br>
generated by AD DC (MS-PAC) that contains signed cached copy of group<br>
ownership for AD users.<br>
<br>
SSSD needs restart after each config change.<br>
<br>
You can do checks step by step to see whether things are working:<br>
<br>
1. Ensure that SSSD on IPA master resolves AD user properly:<br>
<br>
getent passwd user@ad.domain<br>
<br>
Should return non-empty entry.<br>
<br>
</blockquote>
<br>
Returns no values.<br>
<br>
[root@ipa1 ~]# getent passwd sdainard@miovision.corp<br>
[root@ipa1 ~]#<br>
</blockquote></div>
Can you add debug_level=9 to [domain/...] section in<br>
/etc/sssd/sssd.conf, restart sssd and try again?<br>
<br>
In /var/log/sssd/sssd_<domain>.<u></u>log there will be a lot of debug<br>
information that I'd like to see (send it privately).<br>
<br>
If sssd properly tries to talk to winbindd to resolve id, I'd like to<br>
see winbind logs then:<br>
<br>
# smbcontrol all debug 100<br>
# getent passwd sdainard@miovision.corp<br>
# smbcontrol all debug 1<br>
<br>
and send me logs from /var/log/samba.<div class="im"><br>
<br></div></blockquote><div><br></div><div>Done, sending logs outside of list.</div><div><br></div><div>There are some communications errors. I dropped the firewall on the IPA server to test the last couple runs at 'getent passwd sdainard@MIOVISION.CORP'.</div>
<div><br></div><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="im">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
<br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
2. Ensure that SSSD on IPA client resolves AD user properly:<br>
<br>
getent passwd user@ad.domain<br>
<br>
Should return non-empty entry.<br>
<br>
</blockquote>
<br>
[root@snapshot-test ~]# getent passwd sdainard@miovision.corp<br>
[root@snapshot-test ~]#<br>
<br>
</blockquote></div>
Once we solve it for IPA master, we can continue with this part.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
3. Ensure that Kerberos infrastructure works:<br>
<br>
kinit user@ad.domain<br>
kvno -S host ipa.client.domain<br>
<br>
</blockquote>
<br>
[root@ipa1 ~]# kinit sdainard@miovision.corp<br>
Password for sdainard@miovision.corp:<br>
kinit: KDC reply did not match expectations while getting initial<br>
credentials<br>
</blockquote></div>
Expected (realm is case-sensitive).<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
[root@ipa1 ~]# kinit sdainard@MIOVISION.CORP<br>
Password for sdainard@MIOVISION.CORP:<br>
<br>
[root@ipa1 ~]# kvno cifs/dc1.miovision.corp@<u></u>MIOVISION.CORP<br>
cifs/dc1.miovision.corp@<u></u>MIOVISION.CORP: kvno = 41<br>
<br>
[root@ipa1 ~]# kvno -S host ipa1.miolinux.corp<br>
host/ipa1.miolinux.corp@<u></u>MIOLINUX.CORP: kvno = 2<br>
<br>
[root@ipa1 ~]# klist<br>
Ticket cache: FILE:/tmp/krb5cc_0<br>
Default principal: sdainard@MIOVISION.CORP<br>
<br>
Valid starting Expires Service principal<br>
02/06/14 11:54:55 02/06/14 21:54:57 krbtgt/MIOVISION.CORP@<u></u>MIOVISION.CORP<br>
renew until 02/07/14 11:54:55<br>
02/06/14 11:55:38 02/06/14 21:54:57 cifs/dc1.miovision.corp@<u></u>MIOVISION.CORP<br>
renew until 02/07/14 11:54:55<br>
02/06/14 11:56:50 02/06/14 21:54:57 krbtgt/MIOLINUX.CORP@<u></u>MIOVISION.CORP<br>
renew until 02/07/14 11:54:55<br>
02/06/14 11:57:05 02/06/14 21:54:57 host/ipa1.miolinux.corp@<u></u>MIOLINUX.CORP<br>
renew until 02/07/14 11:54:55<br>
</blockquote></div>
Kerberos infrastructure works fine.<span class=""><font color="#888888"><br>
<br>
<br>
-- <br>
/ Alexander Bokovoy<br>
</font></span></blockquote></div><br></div></div>