<div dir="ltr">What about /etc/nsswitch.conf?<div>Does it have "sudo: files sss"?</div></div><div class="gmail_extra"> <div class="gmail_quote">On Mon, Jul 4, 2016 at 3:50 AM, Tomas Simecek <<a href="mailto:simecek.tomas@gmail.com" target="_blank">simecek.tomas@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Dear freeipa users/admins, I'm trying to implement freeipa in our company, so that our Unix admins can authenticate on Linux servers using their Windows AD account. Following this guide <a href="https://www.freeipa.org/page/Active_Directory_trust_setup" target="_blank">https://www.freeipa.org/page/Active_Directory_trust_setup</a> it seems to work well, they can login without problems. What I cannot make working is sudo from their AD accounts on Linux. No matter what I try, it is still: sudo systemctl restart httpd [sudo] password for <a href="mailto:simecek.tomas@sd-stc.cz" target="_blank">simecek.tomas@sd-stc.cz</a>: Sorry, try again. Here's our setup: Freeipa server: CentOS Linux release 7.2.1511 (Core), ipa-server-4.2.0-15.0.1.el7.centos.6.1.x86_64 Freeipa client: the same AD domain name: <a href="http://sd-stc.cz" target="_blank">sd-stc.cz</a> IPA domain: <a href="http://linuxdomain.cz" target="_blank">linuxdomain.cz</a> When digging in logs and googling, I realized that the problem on client side could be: [root@spcss-2t-www ~]# kinit -k kinit: Cannot determine realm for host (principal host/spcss-2t-www@) But this seems to work: [root@spcss-2t-www ~]# kinit <a href="mailto:simecek.tomas@SD-STC.CZ" target="_blank">simecek.tomas@SD-STC.CZ</a> Password for <a href="mailto:simecek.tomas@SD-STC.CZ" target="_blank">simecek.tomas@SD-STC.CZ</a>: [root@spcss-2t-www ~]# klist Default principal: <a href="mailto:simecek.tomas@SD-STC.CZ" target="_blank">simecek.tomas@SD-STC.CZ</a> Valid starting Expires Service principal 07/04/2016 09:36:26 07/04/2016 19:36:26 krbtgt/<a href="mailto:SD-STC.CZ@SD-STC.CZ" target="_blank">SD-STC.CZ@SD-STC.CZ</a> renew until 07/05/2016 09:36:23 My /etc/sssd/sssd.conf: [domain/<a href="http://linuxdomain.cz" target="_blank">linuxdomain.cz</a>] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = <a href="http://linuxdomain.cz" target="_blank">linuxdomain.cz</a> krb5_realm = <a href="http://LINUXDOMAIN.CZ" target="_blank">LINUXDOMAIN.CZ</a> id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = <a href="http://spcss-2t-www.linuxdomain.cz" target="_blank">spcss-2t-www.linuxdomain.cz</a> chpass_provider = ipa ipa_server = <a href="http://svlxxipap.linuxdomain.cz" target="_blank">svlxxipap.linuxdomain.cz</a> ldap_tls_cacert = /etc/ipa/ca.crt override_shell = /bin/bash sudo_provider = ldap ldap_uri = ldap://<a href="http://svlxxipap.linuxdomain.cz" target="_blank">svlxxipap.linuxdomain.cz</a> ldap_sudo_search_base = ou=sudoers,dc=linuxdomain,dc=cz ldap_sasl_mech = GSSAPI ldap_sasl_authid = host/<a href="mailto:spcss-2t-www.linuxdomain.cz@LINUXDOMAIN.CZ" target="_blank">spcss-2t-www.linuxdomain.cz@LINUXDOMAIN.CZ</a> ldap_sasl_realm = <a href="http://LINUXDOMAIN.CZ" target="_blank">LINUXDOMAIN.CZ</a> krb5_server = <a href="http://svlxxipap.linuxdomain.cz" target="_blank">svlxxipap.linuxdomain.cz</a> [sssd] services = nss, sudo, pam, ssh config_file_version = 2 domains = <a href="http://linuxdomain.cz" target="_blank">linuxdomain.cz</a> [nss] homedir_substring = /home .... My /etc/krb5.conf: #File modified by ipa-client-install includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = <a href="http://LINUXDOMAIN.CZ" target="_blank">LINUXDOMAIN.CZ</a> dns_lookup_realm = true dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = yes udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] <a href="http://LINUXDOMAIN.CZ" target="_blank">LINUXDOMAIN.CZ</a> = { pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .<a href="http://linuxdomain.cz" target="_blank">linuxdomain.cz</a> = <a href="http://LINUXDOMAIN.CZ" target="_blank">LINUXDOMAIN.CZ</a> <a href="http://linuxdomain.cz" target="_blank">linuxdomain.cz</a> = <a href="http://LINUXDOMAIN.CZ" target="_blank">LINUXDOMAIN.CZ</a> Would you please suggest which way to investigate? Thanks Tomas Simecek </div> -- Manage your subscription for the Freeipa-users mailing list: <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project </blockquote></div> </div>