I have been trying to nail down the process of binding a Centos 7 install to a Windows domain but am struggling. I have managed to successfully do this in the past on a couple of boxes but I am now trying to document the process and it's doing very strange things.
I have managed to perform the bind using the following process:
- Install and configure ntp
- Install packages: realmd, oddjob, oddjob-mkhomedir, sssd, samba-common, krb5-workstation, adcli
- Create a Kerberos ticket: kinit username@MY.DOMAIN
- realm join
- modify sssd config
[sssd] domains = my.domain config_file_version = 2 services = nss, pam [domain/my.domain] ad_domain = my.domain krb5_realm = MY.DOMAIN realmd_tags = manages-system joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = false fallback_homedir = /home/%u@%d access_provider = ad override_homedir = /home/%u override_shell = /bin/bash
- restart sssd service
This has worked in the past but for some reason I was not able to login using my network credentials, however my colleague was able to log in successfully using only one of his accounts.
When we added debug to the sssd config the log file displayed the error:
Could not convert objectSID [MY AD SID HERE] to a UNIX ID
It also picked out my actual account name from AD so it is definitely pull information. We have the same rights on the system and it just doesn't make sense.
Any suggestions on what else I could try?