<div dir="ltr">I am using sssd and from ipa clients the authentication is not working (works fine if I ssh on the ipa-server). I thought it could be due to the external groups being empty and not mapping the AD users.<div><br></div><div>Anyway this is the krb5.conf on the ipa client:</div><div><br></div><div><div>#File modified by ipa-client-install</div><div><br></div><div>includedir /var/lib/sss/pubconf/krb5.include.d/</div><div><br></div><div>[libdefaults]</div><div> default_realm = IPA.TWEEK</div><div> dns_lookup_realm = true</div><div> dns_lookup_kdc = true</div><div> rdns = false</div><div> ticket_lifetime = 24h</div><div> forwardable = yes</div><div> udp_preference_limit = 0</div><div> default_ccache_name = KEYRING:persistent:%{uid}</div><div><br></div><div>[realms]</div><div> IPA.TWEEK = {</div><div> kdc = centos.ipa.tweek:88</div><div> master_kdc = centos.ipa.tweek:88</div><div> admin_server = centos.ipa.tweek:749</div><div> default_domain = ipa.tweek</div><div> pkinit_anchors = FILE:/etc/ipa/ca.crt</div><div> auth_to_local = RULE:[1:$1@$0](^.*@AD.TWEEK$)s/@AD.TWEEK/@ad.tweek/</div><div> auth_to_local = DEFAULT</div><div> }</div><div> AD.TWEEK = {</div><div> kdc = centos.ipa.tweek:88</div><div> pkinit_anchors = FILE:/etc/ipa/ca.crt</div><div> }</div><div><br></div><div>[domain_realm]</div><div> .ipa.tweek = IPA.TWEEK</div><div> ipa.tweek = IPA.TWEEK</div><div> .ad.tweek = AD.TWEEK</div><div> ad.tweek = AD.TWEEK</div></div><div><br></div><div><br></div><div>and this is the error I see in krb5_child.log</div><div><br></div><div><div>(Fri Jul 10 12:38:05 2015) [[sssd[krb5_child[13235]]]] [main] (0x0400): Will perform online auth</div><div>(Fri Jul 10 12:38:05 2015) [[sssd[krb5_child[13235]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [AD.TWEEK]</div><div>(Fri Jul 10 12:38:05 2015) [[sssd[krb5_child[13235]]]] [get_and_save_tgt] (0x0020): 996: [-1765328378][Client 'freeipa@AD.TWEEK' not found in Kerberos database]</div><div>(Fri Jul 10 12:38:05 2015) [[sssd[krb5_child[13235]]]] [map_krb5_error] (0x0020): 1065: [-1765328378][Client 'freeipa@AD.TWEEK' not found in Kerberos database]</div></div><div><br></div><div><br></div><div>also</div><div><br></div><div># kinit freeipa@AD.TWEEK</div><div>kinit: Cannot find KDC for realm "AD.TWEEK" while getting initial credentials</div><div><br></div><div>any idea what's the problem? It seems kerberos cannot find users in the AD subdomain</div><div><br></div><div><br></div><div>this is my sssd.conf</div><div><br></div><div><div>[domain/ipa.tweek]</div><div>debug_level = 6</div><div>cache_credentials = True</div><div>krb5_store_password_if_offline = True</div><div>ipa_domain = ipa.tweek</div><div>id_provider = ipa</div><div>auth_provider = ipa</div><div>ldap_tls_cacert = /etc/ipa/ca.crt</div><div>ipa_hostname = someaddress_here</div><div>chpass_provider = ipa</div><div>ipa_server = _srv_, centos.ipa.tweek</div><div>dns_discovery_domain = ipa.tweek</div><div>cn=ad_admins_external,cn=groups,cn=accounts,dc=ipa,dc=tweek</div><div>subdomains_provider = ipa</div><div>[sssd]</div><div>services = nss, pam, pac, ssh</div><div>config_file_version = 2</div><div>debud_level = 6</div><div>domains = ipa.tweek</div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jul 10, 2015 at 12:29 PM, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On Fri, 10 Jul 2015, Angelo Pantano wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I have a freeipa server trusting an active directory domain, if I ssh to<br>
the ipa server everything works, but if I try to ssh on an ipa client the<br>
authentication fails.<br>
<br>
I noticed on the server that the wbinfo -n 'AD\Domain Users' is failing:<br>
<br>
failed to call wbcLookupName: WBC_ERR_DOMAIN_NOT_FOUND<br>
<br>
Also in the logs I see:<br>
<br>
log.winbindd-dc-connect: get_sorted_dc_list: attempting lookup for name<br>
ad.local (sitename NULL)<br>
<br>
everything else works though, I can getent users and group just fine.<br>
<br>
Can you please help me?<br>
</blockquote></div></div>
We don't use wbinfo and don't recommend it with FreeIPA AD trusts -- at<br>
least with Fedora 18+ and RHEL7+. When your FreeIPA server is deployed<br>
on those platforms, SSSD is used to resolve users, not winbindd.<br>
Winbindd is only used to manage forest topology.<span class="HOEnZb"><font color="#888888"><br>
<br>
<br>
<br>
-- <br>
/ Alexander Bokovoy<br>
</font></span></blockquote></div><br></div>