4

I need to configure the sssd so that we can use Windows Active directory username to login to Redhat machine.

I have below configuration file for sssd.conf file

I get the following error in log.

What could be wrong with it.

[sssd]
config_file_version = 2
domains = CORE.MYCOMPANY.COM
services = nss, pam 
[domain/CORE.MYCOMPANY.COM]
# Uncomment if you need offline logins
cache_credentials = true
id_provider = ad
auth_provider = ad
access_provider = ad     
# Uncomment if service discovery is not working
ad_server = CORE.MYCOMPANY.COM    
# Uncomment if you want to use POSIX UIDs and GIDs set on the AD side
# ldap_id_mapping = False
# Comment out if the users have the shell and home dir set on the AD side
default_shell = /bin/bash
fallback_homedir = /home/%d/%u
# Uncomment and adjust if the default principal SHORTNAME$@REALM is not available
# ldap_sasl_authid = host/client.ad.example.com@AD.EXAMPLE.COM
# Comment out if you prefer to user shortnames.
use_fully_qualified_names = True

Start the service

[cloud-user@d760770 ~]$  sudo service sssd restart
Redirecting to /bin/systemctl restart  sssd.service
Job for sssd.service failed. See 'systemctl status sssd.service' and 'journalctl -xn' for details.

Error log

sssd_CORE.MYCOMPANY.COM.log

(Wed Mar  4 19:41:21 2015) [sssd[be[CORE.MYCOMPANY.COM]]] [be_process_init] (0x0010): fatal error initializing data providers
(Wed Mar  4 19:41:21 2015) [sssd[be[CORE.MYCOMPANY.COM]]] [main] (0x0010): Could not initialize backend [2]
(Wed Mar  4 19:41:25 2015) [sssd[be[CORE.MYCOMPANY.COM]]] [load_backend_module] (0x0010): Error (2) in module (ad) initialization (sssm_ad_id_init)!

sssd.log

(Wed Mar  4 18:45:04 2015) [sssd] [mt_svc_exit_handler] (0x0010): Process [CORE.MYCOMPANY.COM], definitely stopped!
(Wed Mar  4 19:41:25 2015) [sssd] [mt_svc_exit_handler] (0x0010): Process [CORE.MYCOMPANY.COM], definitely stopped!
  • 1
    If you're going to auth against AD you probably need to join the domain. See fedorahosted.org/sssd/wiki/Configuring_sssd_with_ad_server – Andy Mar 5 '15 at 13:23
  • Without joining its not possible to authenticate and get groups of given user? – user2230605 Mar 5 '15 at 20:25
  • Generally not. Active Directory authentication is based on trust and delegation. It is possible to use AD as an LDAP with a bind account, but you are better off getting it joined to the domain. Is that a problem in your setup? – Andy Mar 7 '15 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.