<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1467915308743_18778">I have successfully established trust and am able to obtain ticket granting ticket</div><div id="yui_3_16_0_ym19_1_1467915308743_18778">kinit user@AD_DOMAIN.COM</div><div id="yui_3_16_0_ym19_1_1467915308743_18778">I can also do kinit admin@IPA_DOMAIN.COM</div><div id="yui_3_16_0_ym19_1_1467915308743_18778" dir="ltr">ssh admin@IPA_DOMAIN.COM also works</div><div id="yui_3_16_0_ym19_1_1467915308743_18778" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1467915308743_18778" dir="ltr">however, ssh user@AD_DOMAIN.COM or user@ad_domain.com fails</div><div id="yui_3_16_0_ym19_1_1467915308743_18778" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1467915308743_18778" dir="ltr">I have checked that there are no hbac rules other then the default allow_all rule</div><div id="yui_3_16_0_ym19_1_1467915308743_18778" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1467915308743_18778" dir="ltr">in sssd_ssh.log see<br>permission denied (6) error</div><div id="yui_3_16_0_ym19_1_1467915308743_18778" dir="ltr"> </div><div id="yui_3_16_0_ym19_1_1467915308743_18778" dir="ltr">in sssd_ipa.domain.log file I see<br>pam_handler_callback 6 permission_denied</div><div id="yui_3_16_0_ym19_1_1467915308743_18778" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1467915308743_18778" dir="ltr">in sssd_nss.log </div><div id="yui_3_16_0_ym19_1_1467915308743_19044"><span id="yui_3_16_0_ym19_1_1467915308743_19045">Unable to get information from Data Provider</span></div><div id="yui_3_16_0_ym19_1_1467915308743_19046"><span id="yui_3_16_0_ym19_1_1467915308743_19047">Error: 3 Account info lookup failed</span></div><div id="yui_3_16_0_ym19_1_1467915308743_18778" dir="ltr"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19048"><span id="yui_3_16_0_ym19_1_1467915308743_19049">Will try to return what we have in cache</span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19048"><span><br></span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19048"><span id="yui_3_16_0_ym19_1_1467915308743_19103">in /var/log/secure</span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19048"> received for user user@AD_DOMAIN.COM: 6 (Permission denied) <span><br></span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19048"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19048">I can provided full logs if necessary to diagnose the above problem.</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19048"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19048">----------</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19048">Additionally, I would like to be able to login as <b>user </b>not <b id="yui_3_16_0_ym19_1_1467915308743_19166">user@AD_DOMAIN.COM</b><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19048">My understanding that only thing that I have to change to make this happen is /etc/krb5.conf</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19048">for line <br><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19215">[libdefaults]</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19216"> default_realm=AD_DOMAN.COM </div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19216">and then restarting ipa services.</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19216"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467915308743_19216">However, when I do this I get failure to restart Samba service</div></div></div></body></html>