I'm stuck with Kerberos - sssd - AD. I've tried a lot of things, with lot of googling, in LinuxMint, Ubuntu 16.04 and Debian 9. I have always the same result :

  • kinit username works fine
  • msktutil -u --computer-name $(hostname) --server ad-server.univ-fr looks good
  • ldapsearch -Y GSSAPI works fine

but getent passwd -s sss username does nothing nor id username!

I tried with a very minimalistic Debian 9 distribution with openssh-server, krb-5-user, msktutil, sssd and configuration files /etc/sssd/sssd.conf and /etc/krb5.conf. I did not change /etc/nsswitch as it seems to be right configuring with compact sss on passwd, group, shadow and gshadow.

It looks like that sss is never called. So I did not find any log that could help me to track the bug. I don't know if I miss a package or something else.

My question : How could I find out how nsswitch works and when it ask sssd to find a AD username?


Have a look into Anatomy of SSSD user lookup for an overview of the lookup process or Troubleshooting Guide for how to get logs to see what might be wrong in the daemon.

For quick reference, you may need to add debug_level=10 into all sections in the sssd.conf file, restart sssd and re-run your tasks. Then look into /var/log/sssd*.

  • Right, in this case additional debug logging and reviewing the logs seems to be recommended. – U880D May 23 '18 at 14:00
  • Thanks a lot. I did a very minimalistic configuration in sssd.conf file,as said in Troubleshooting backend, and sssd start correctly with good information in /var/log/sssd/*. Now I can continue. – JL M May 25 '18 at 7:44
  • Sometimes SSSD will not restart event if configuration files seem good and there is very little things in logs. This could be corrected by deleting the sssd pid file : rm /var/run/sssd.pid. This was my main problem/solution. – JL M Jun 4 '18 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.