I try to automate the authentication on CentOS 7 Hosts over my AD with the realm commands.

It totally works when I execute the following commands by myself.

$ yum -y install realmd oddjob oddjob-mkhomedir sssd samba-common
$ realm join -U admin domain.com
$ realm permit -g LinuxAdmins@domain.com

In addition to that I replace the following lines in /etc/sssd/sssd.conf and restart sssd service.

use_fully_qualified_names = False
fallback_homedir = /home/%d/%u

$systemctl restart sssd

After those steps I can log in on that specific CentOS Host with any permitted user of my Active Directory

Now the Problem:

If I run the following script on a CentOS Host as root it seems like everything has worked.

 yum -y install realmd oddjob oddjob-mkhomedir sssd samba-common
 echo "Password" | realm join -U admin domain.com
 realm permit -g LinuxAdmins@domain.com
 sed -i -e 's/use_fully_qualified_names = True/use_fully_qualified_names = False/g' /etc/sssd/sssd.conf
 sed -i -e 's#fallback_homedir = /home/%u@%d#fallback_homedir = /home/%d/%u#g' /etc/sssd/sssd.conf
 systemctl restart sssd

If I try to log in as a permitted AD user it says permission denied

I checked /etc/sssd/sssd.conf for any possible sed-caused problems, but that seems fine. Also running the command realm list seems like there is no problem.

# realm list
type: kerberos
realm-name: DOMAIN.COM
domain-name: domain.com
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common
login-formats: %U
login-policy: allow-permitted-logins
permitted-groups: LinuxAdmins@domain.com

The output of this command is exactly the same when I run it after manually executing the commands.

Anybody any idea how to handle that?

  • No winbind or like restart ? – Archemar Jul 28 '16 at 16:25
  • @Archemar I restarted the system but that doesn't help either – Tem Jul 29 '16 at 6:45
  • the only diff is echo "Passwd" | realm are you sure this is allowed ? are there no other option to give password ? – Archemar Jul 29 '16 at 6:53
  • @Archemar yes it works when I run that in command line as root – Tem Jul 29 '16 at 7:08

I had the same issue and I noticed that ldap_id_mapping = True was my solution. This is in /etc/sssd/sssd.conf.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.