<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> Sumit Bose wrote: <blockquote cite="mid20151208164028.GH16629@p.redhat.com" type="cite"> <pre wrap="">On Tue, Dec 08, 2015 at 02:33:40PM +0100, Stefano Cortese wrote: </pre> <blockquote type="cite"> <pre wrap="">Hi Sumit yes it works commenting out the  line 'enable_only = sssd' and making the file immutable , namely the .k5login file is read and enforced. But respect to the solution emptying completely the snippet, it is lost the possibility to perform the same enforcement via an 'auth_to_local_names' entry in /etc/krb5.conf for the given realm in which the service' principal is mapped onto the destination posix account </pre> </blockquote> <pre wrap=""> This is expected because if either the principal or the user name is known to SSSD the localauth plugin will take control because by default the added modules are registered first (see [plugins] section of man krb5.conf for details). To check auth_to_local_names first you can try enable_only=names,k5login,sssd </pre> </blockquote> It does not work for me. Changed the snippet and made immutable, after sssd restart the behaviour is the same. It does not work also putting k5login or names alone. Note that the sssd version in SL6.7<->RHEL6.7 is 1.12.4-47 Should those keywords work in this version ? S. <blockquote cite="mid20151208164028.GH16629@p.redhat.com" type="cite"> <pre wrap="">HTH bye, Sumit </pre> </blockquote> </body> </html>