<div dir="ltr">Ok, I increased the debug level as you recommended and it's given me a lot of useful info. Before I go any further trying to troubleshoot that mass of info on this mailing list though, I would like to double check something I came across. In the debug output I noticed this line:<div><div>
<p class=""><span class="">"No ccache file for user [<a href="mailto:bobt@ad.bbg.net">bobt@ad.bbg.net</a>] found."</span></p><p class="">I then searched this error and found this thread in which the OP seems to have basically the same setup as me:</p><p class=""><a href="https://lists.fedorahosted.org/pipermail/sssd-users/2013-January/000379.html">https://lists.fedorahosted.org/pipermail/sssd-users/2013-January/000379.html</a><br></p><p class="">I started playing with kinit on the ubuntu machine that I'm trying to log into, and got this error:</p><p class="">"kinit: Cannot find KDC for realm "<a href="http://AD.BBG.NET">AD.BBG.NET</a>" while getting initial credentials"<br></p><p class="">After reading through some of the replies on the above thread, I saw a post that basically says that while the initial user info lookup is via FreeIPA, to actually authenticate a user the ipa client machine must connect directly to the AD controller. If this is true, it basically means the setup I was planning to use (FreeIPA in the cloud replicating/proxying local AD user accounts) is not going to work as I'd hoped. Could you confirm if this behaviour is in fact correct?</p>Thanks,<br>Guy</div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 9 August 2016 at 18:47, Justin Stephenson <span dir="ltr"><<a href="mailto:jstephen@redhat.com" target="_blank">jstephen@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<p>Hello,</p>
<p>You may need to increase the debug level to 9 and look in the
sssd_<ipadomain>.log for failures after the failed login
attempt - i would look in between log messages 'Got request for
bobt...' and 'Backend returned' messages<br>
</p>
<p> <a href="https://fedorahosted.org/sssd/wiki/Troubleshooting" target="_blank">https://fedorahosted.org/sssd/<wbr>wiki/Troubleshooting</a></p>
<p>You can also send the debug logs here for review.</p>
<p>Make sure logins and lookups are working on the IPA server first
before troubleshooting the IPA client.<br>
</p>
<p>Kind regards,</p>
<p>Justin Stephenson<br>
</p><div><div class="h5">
<div>On 08/09/2016 07:32 PM, Guy Knights
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">I've set up a freeipa server on a centos 7 machine
and have successfully configured a 2-way trust between it and
our active directory domain controller. I've also installed
ipa-client on an ubuntu 14.04 machine and have run
ipa-client-install, which has apparently successfully joined the
FreeIPA domain.<br>
<div><br>
</div>
<div>So far, I can successfully do the following:</div>
<div><br>
</div>
<div>1. Log into the FreeIPA machine with an AD user account.</div>
<div>2. Log into the Ubuntu machine with a FreeIPA account.</div>
<div>3. Run 'getent passwd <freeipa username>' on the
Ubuntu machine and have it return the associated FreeIPA user
account details (eg. "jackt:*:1131000005:<wbr>1131000005:Jack
Test:/home/<a href="http://ipa.bbg.net/jackt:/bin/bash" target="_blank">ipa.bbg.net/jackt:/<wbr>bin/bash</a>")</div>
<div>4. Run 'getent passwd <ad username>' on the Ubuntu
machine and have it return the associated AD user account
details (eg. "<a href="mailto:bobt@ad.bbg.net:*:1946801107:1946801107::/home/" target="_blank">bobt@ad.bbg.net:*:1946801107:<wbr>1946801107::/home/</a><a href="http://ad.bbg.net/bobt:/bin/bash" target="_blank">ad.bbg.net/<wbr>bobt:/bin/bash</a>")</div>
<div><br>
</div>
<div>What I can't do is log into the Ubuntu machine with the AD
user. I'm using the following SSH command from the command
line on my mac:</div>
<div><br>
</div>
<div>ssh -o User=<a href="mailto:bobt@ad.bbg.net" target="_blank">bobt@ad.bbg.net</a> <a href="http://vm1.bbg.com" target="_blank">vm1.bbg.com</a></div>
<div><br>
</div>
<div>It asks me for the password, I enter it and it says
permissions denied, please try again. I set the debug level in
SSSD on the ubuntu client to 5 and this is what shows up in
the log during the login attempt:</div>
<div><br>
</div>
(Tue Aug 9 16:25:56 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]]
[be_get_account_info] (0x0100): Got request for
[4097][1][name=bobt]<br>
(Tue Aug 9 16:25:56 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]]
[acctinfo_callback] (0x0100): Request processed. Returned
3,95,Account info lookup failed<br>
(Tue Aug 9 16:25:57 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]]
[acctinfo_callback] (0x0100): Request processed. Returned
0,0,Success<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]]
[be_get_account_info] (0x0100): Got request for
[3][1][name=bobt]<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]]
[acctinfo_callback] (0x0100): Request processed. Returned
3,95,Account info lookup failed<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]] [be_pam_handler]
(0x0100): Got request with the following data<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]] [pam_print_data]
(0x0100): command: PAM_AUTHENTICATE<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]] [pam_print_data]
(0x0100): domain: <a href="http://ad.bbg.net" target="_blank">ad.bbg.net</a><br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]] [pam_print_data]
(0x0100): user: <a href="mailto:bobt@ad.bbg.net" target="_blank">bobt@ad.bbg.net</a><br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]] [pam_print_data]
(0x0100): service: sshd<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]] [pam_print_data]
(0x0100): tty: ssh<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]] [pam_print_data]
(0x0100): ruser:<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]] [pam_print_data]
(0x0100): rhost: 192.168.100.157<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]] [pam_print_data]
(0x0100): authtok type: 1<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]] [pam_print_data]
(0x0100): newauthtok type: 0<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]] [pam_print_data]
(0x0100): priv: 1<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]] [pam_print_data]
(0x0100): cli_pid: 16230<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]] [krb5_auth_send]
(0x0100): No ccache file for user [<a href="mailto:bobt@ad.bbg.net" target="_blank">bobt@ad.bbg.net</a>] found.<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service
'IPA'<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]]
[be_resolve_server_process] (0x0200): Found address for server <a href="http://dc.ipa.bbg.net" target="_blank">dc.ipa.bbg.net</a>:
[192.168.100.14] TTL 3600<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]]
[be_pam_handler_callback] (0x0100): Backend returned: (0, 4,
<NULL>) [Success]<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]]
[be_pam_handler_callback] (0x0100): Sending result [4][<a href="http://ad.bbg.net" target="_blank">ad.bbg.net</a>]<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]]
[be_pam_handler_callback] (0x0100): Sent result [4][<a href="http://ad.bbg.net" target="_blank">ad.bbg.net</a>]<br>
(Tue Aug 9 16:27:54 2016) [sssd[be[<a href="http://ipa.bbg.net" target="_blank">ipa.bbg.net</a>]]]
[child_sig_handler] (0x0100): child [16313] finished
successfully.
<div><br>
</div>
<div>Can anyone explain why it's saying account info lookup
failed when it can get the account info fine via getent?</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Guy</div>
</div>
<br>
<fieldset></fieldset>
<br>
</blockquote>
<br>
</div></div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div style="font-size:small"><img src="http://www.bluebatgames.com/wp-content/uploads/2015/10/gt-novo-1-t.png"><br></div></div></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><b style="font-size:small"><div style="text-align:left"><b>Guy Knights</b></div></b><span style="font-size:small"><div style="text-align:left">Senior Systems Engineer</div></span><span style="font-size:small"><div style="text-align:left">BlueBat Games Inc.</div></span><span style="font-size:small"><div style="text-align:left">Ph: 778-379-5120</div></span><div><div><div style="text-align:left;font-size:small">Email: <a href="mailto:guy@bluebatgames.com" target="_blank">guy@bluebatgames.com</a></div></div></div></blockquote></div></div>
</div>