0

I have configured the users through SSSD native AD support. However when I try to access the share it's mapped as "Unix User\username@domain" instead of "domain\username".

My sssd:

[sssd]
config_file_version = 2
domains = domain.com
services = nss, pam

[nss]

[pam]

[domain/domain.com]
cache_credentials = true
id_provider = ad
auth_provider = ad
access_provider = simple
default_shell = /bin/zsh
fallback_homedir = /home/%d/%u
simple_allow_users = user@domain.com
use_fully_qualified_names = true
ldap_id_mapping = true
ldap_schema = ad
ldap_idmap_range_min = 100000
ldap_idmap_range_max = 2000100000
ldap_idmap_range_size = 200000000
ldap_idmap_default_domain = DOMAIN.COM
ignore_group_members = true

My krb:

[libdefaults]
    default_realm     = DOMAIN.COM
    clockskew         = 300
    ticket_lifetime   = 1d
    forwardable       = true
    proxiable         = true
    dns_lookup_realm  = true
    dns_lookup_kdc    = true
    allow_weak_crypto = true

[realms]
    DOMAIN.COM = {
        default_domain = DOMAIN.COM
        auth_to_local = RULE:[1:$1@$0](^.*@DOMAIN.COM$)s/@DOMAIN.COM/@domain.com/
    }

[domain_realm]
    .kerberos.server = DOMAIN.COM
    .domain.com = DOMAIN.COM
    domain.com = DOMAIN.COM
    domain = DOMAIN.COM

[appdefaults]
    pam = {
        ticket_lifetime         = 1d
        renew_lifetime          = 1d
        forwardable             = true
        proxiable               = false
        retain_after_close      = false
        minimum_uid             = 0
        debug                   = false
    }

[logging]
    default      = FILE:/var/log/krb5libs.log
    kdc          = FILE:/var/log/kdc.log
    admin_server = FILE:/var/log/kadmind.log

My samba:

[Global]
  netbios name = HOSTNAME
  workgroup = DOMAIN.COM
  realm = DOMAIN.COM
  server string = %h
  security = ads
  client signing = yes
  client use spnego = yes
  encrypt passwords = yes
  password server = pdc.domain.com
  kerberos method = system keytab
  dedicated keytab file = /etc/krb5.keytab

  idmap config * : backend = tdbsam

  preferred master = no
  dns proxy = no
  wins support = no

  inherit acls = Yes
  map acl inherit = Yes
  acl group control = yes

  load printers = no
  #debug level = 3
  use sendfile = no

  #log level = 10

  strict allocate = yes
  aio read size = 16384
  aio write size = 16384
  aio write behind = true
  socket options = TCP_NODELAY IPTOS_LOWDELAY
0

I needed to point /usr/lib/libwbclient.so.* libraries to /usr/lib/sssd/modules/libwbclient.so.*. I sent a bug report for Gentoo to properly handle it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.