2

I have been trying to nail down the process of binding a Centos 7 install to a Windows domain but am struggling. I have managed to successfully do this in the past on a couple of boxes but I am now trying to document the process and it's doing very strange things.

I have managed to perform the bind using the following process:

  • Install and configure ntp
  • Install packages: realmd, oddjob, oddjob-mkhomedir, sssd, samba-common, krb5-workstation, adcli
  • Create a Kerberos ticket: kinit username@MY.DOMAIN
  • realm join
  • modify sssd config
[sssd]
domains = my.domain
config_file_version = 2
services = nss, pam

[domain/my.domain]
ad_domain = my.domain
krb5_realm = MY.DOMAIN
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = false
fallback_homedir = /home/%u@%d
access_provider = ad
override_homedir = /home/%u
override_shell = /bin/bash
  • restart sssd service

This has worked in the past but for some reason I was not able to login using my network credentials, however my colleague was able to log in successfully using only one of his accounts.

When we added debug to the sssd config the log file displayed the error:

Could not convert objectSID [MY AD SID HERE] to a UNIX ID

It also picked out my actual account name from AD so it is definitely pull information. We have the same rights on the system and it just doesn't make sense.

Any suggestions on what else I could try?

1

The solution was to extend the id map range visible in ldap ldap, our ad is very large and it looks like the default range was not big enough to cover all the users in the range, which means that it would only be able to convert the objectSID which it could see. My SID was way above my colleagues, which is why he was able to login but I was not.

The solution was to add the following to the main part of the SSSD.conf

ldap_idmap_default_domain_sid = SID OF THE DOMAIN
ldap_idmap_range_min = 200000
ldap_idmap_range_max = 2000200000
ldap_idmap_range_size = 1000000

Ref: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org/thread/2YYG6LPUYWX2TUTD5SY5NNTHOTQQIJTD/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.