1

I have installed an IPA Server, created a replica agreement and set up a one way trust to our AD Forest. The IPA servers have integrated DNS and are in their own dns zone. This works as expected, I am able to log into the IPA servers with my AD account.

My issue is when setting up a client, I am able to use IPA users (ex. admin) but unable to authenticate/login with my AD account.

Running an HBAC test on the IPA server verified my AD user has access to the client. I can also successfully obtain a kerberos ticket for the AD users on my IPA client.

When I perform an id on the AD account from the IPA client I receive an

unknown user error

When I try to ssh, secure log shows, illegal user/unknown user to underlying authentication module.

Environment Details are as follows:

  • IPA Version 4.4.0
  • IPA Server:ipaserver01.ipa.us.example.com CentOS 7.3
  • IPA Replica:ipaserver02.ipa.us.example.com CentOS 7.3
  • IPA Client:ipaclient.us.example.com CentOS 7.3
  • IPA REALM: IPA.US.EXAMPLE.COM
  • AD Forest: win.example.com
  • User: John.Doe@usa.win.example.com

/etc/sssd/sssd.conf:

[domain/ipa.us.example.com]

cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = ipa.us.example.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ldap_tls_cacert = /etc/ipa/ca.crt
ipa_hostname = ipaclient.us.example.com
chpass_provider = ipa
ipa_server = _srv_, ipaserver02.ipa.us.example.com
dns_discovery_domain = ipa.us.example.com
subdomain_inherit = ignore_group_members
ignore_group_members = True
debug_level = 6

[sssd]
domains = ipa.us.example.com
config_file_version = 2
services = nss, sudo, pam, ssh, pac
subdomain_enumerate = all
debug_level = 6

[nss]
debug_level = 6
homedir_substring = /home

/etc/krb5.conf

#File modified by ipa-client-install

includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/

[libdefaults]
  default_realm = IPA.US.EXAMPLE.COM
  dns_lookup_realm = true
  dns_lookup_kdc = true
  rdns = false
  ticket_lifetime = 24h
  forwardable = true
  udp_preference_limit = 0
  default_ccache_name = KEYRING:persistent:%{uid}


[realms]
  IPA.US.EXAMPLE.COM = {
    pkinit_anchors = FILE:/etc/ipa/ca.crt

  }


[domain_realm]
  .ipa.us.example.com = IPA.US.EXAMPLE.COM
  ipa.us.example.com = IPA.US.EXAMPLE.COM
  ipaclient.us.example.com = IPA.US.EXAMPLE.COM
  .us.example.com = IPA.US.EXAMPLE.COM
  us.example.com = IPA.US.EXAMPLE.COM

/var/log/secure

May 17 10:23:23 lxmatazan100s sshd[8256]: reverse mapping checking getaddrinfo for dhcp-ngkusernetworkuzo-1921690252.revonly.kn [192.169.0.252] failed - POSSIBLE BREAK-IN ATTEMPT!
May 17 10:23:47 lxmatazan100s sshd[8256]: Invalid user John.Doe@usa.win.example.com from 192.169.0.252
May 17 10:23:47 lxmatazan100s sshd[8256]: input_userauth_request: invalid user John.Doe@usa.win.example.com [preauth]
May 17 10:23:50 lxmatazan100s sshd[8256]: Failed password for invalid user John.Doe@usa.win.example.com from 192.169.0.252 port 51819 ssh2
May 17 10:23:53 lxmatazan100s sshd[8256]: Failed password for invalid user John.Doe@usa.win.example.com from 192.169.0.252 port 51819 ssh2
May 17 10:23:56 lxmatazan100s sshd[8256]: Failed password for invalid user John.Doe@usa.win.example.com from 192.169.0.252 port 51819 ssh2
May 17 10:23:56 lxmatazan100s sshd[8256]: error: PAM: User not known to the underlying authentication module for illegal user John.Doe@usa.win.example.com from 192.169.0.252
May 17 10:23:56 lxmatazan100s sshd[8256]: Failed keyboard-interactive/pam for invalid user John.Doe@usa.win.example.com from 192.169.0.252 port 51819 ssh2
May 17 10:23:56 lxmatazan100s sshd[8256]: Connection closed by 192.169.0.252 [preauth]

/var/log/sssd/sssd_ipa.us.example.com (These entries exist for each domain in the AD forest, multiple times!)

(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [_dp_req_recv] (0x0400): DP Request [Account #134]: Receiving request data.
(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [dp_req_reply_gen_error] (0x0080): DP Request [Account #134]: Finished. Backend is currently offline.
(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1:1:U:usa.win.example.com:name=john.doe@usa.win.example.com] from reply table
(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [dp_req_destructor] (0x0400): DP Request [Account #134]: Request removed.
(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [dp_req_destructor] (0x0400): Number of active DP request: 0

/var/log/sssd/sssd_nss.log

(Again, these exist for each domain in the AD forest)

(Wed May 17 08:25:50 2017) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): Requesting info for [john.doe@usa.win.example.com]
(Wed May 17 08:25:50 2017) [sssd[nss]] [sysdb_search_user_by_upn] (0x0400): No entry with upn [john.doe@usa.win.example.com] found.
(Wed May 17 08:25:50 2017) [sssd[nss]] [get_dp_name_and_id] (0x0400): Not a LOCAL view, continuing with provided values.
(Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x7f99f622c880:1:john.doe@usa.win.example.com:U@usa.win.example.com]
(Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [usa.win.example.com][0x1][BE_REQ_USER][1][name=john.doe@usa.win.example.com:U]
(Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x7f99f622c880:1:john.doe@usa.win.example.com:U@usa.win.example.com]
(Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x7f99f622c880:1:john.doe@usa.win.example.com:U@nw.win.example.com]
(Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
(Wed May 17 08:25:50 2017) [sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data Provider
Error: 3, 5, Failed to get reply from Data Provider
Will try to return what we have in cache

The one thing I have left to try is move the client to the ipa.us.example.com dns domain, although the documentation specifically mentions clients do not need to be in the same dns domain as the server.

EDIT** - I previously had commented out a line /etc/pam.d/password-auth thinking it fixed ipa (non trust) users authentication. I am now thinking it allowed any user to authenticate because when I removed the user from the HBAC rule they could still authenticate. I have uncommented the line, and now IPA users are unable to authenticate. I can still do a lookup for those users (and not AD users).

/etc/pam.d/password-auth

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        [default=1 success=ok] pam_localuser.so
auth        [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        sufficient    pam_sss.so forward_pass
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
#The following line is what I had commented out
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so

password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     optional      pam_oddjob_mkhomedir.so umask=0077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so

EDIT #2**

I have now gotten ipa users to work with my client, I had to include "selinux_provider=none" in the [domain/ipa.us.example.com] section of sssd.conf. AD Trust users are still failing with the same errors.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.