2

When I try to do a su user1@ADREALM.COM I get a "user does not exist" message.

user1@ADREALM.COM exists in Active Directory. I can do kinit user1@ADREALM.COM successfully and get a ticket. Here are the steps I did:

  1. I have MIT KDC on CentOS 7 CENTOSREALM.COM and Active Directory realm ADREALM.COM
  2. On CentOS I did realm join ADREALM.COM which gave "* Successfully enrolled machine in realm". I can see the centos hostname in Active Directory Computers container.
  3. But I cannot login to the CentOS server with user1@ADREALM.COM this user exists in AD.

Where do I look for errors or steps to debug this issue?

The sssd.conf content:

[sssd]
domains = adrealm.com
config_file_version = 2
services = nss, pam

[domain/adrealm.com]
ad_server = adrealm.com
ad_domain = adrealm.com
krb5_realm = ADREALM.COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
debug_level = 3
  • What does your /etc/sssd/sssd.conf file look like? – Christophe Drevet-Droguet Sep 4 '18 at 12:40
  • [sssd] domains = adrealm.com config_file_version = 2 services = nss, pam [domain/adrealm.com] ad_server = adrealm.com ad_domain = adrealm.com krb5_realm = ADREALM.COM realmd_tags = manages-system joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%u@%d access_provider = ad debug_level = 3 – ebeb Sep 5 '18 at 13:08
  • @Christophe Drevet-Droguet above is /etc/sssd/sssd.conf: In addition I checked forward and reverse dns from centos to Active Dir works fine. I have updated /etc/hosts, /etc/resolv.conf, /etc/krb5.conf based on many suggestions. Thx!! – ebeb Sep 5 '18 at 13:18
  • Also if I get this error with ldapwhoami: ldapwhoami -Y GSSAPI -H ldap://adserver1.adrealm.com SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database) – ebeb Sep 5 '18 at 13:41
  • Did you try to use the name user1@adrealm.com? I'm sure LDAP is not case sensitive, but I think sssd is. If you want to use upper case, it should be also in the sssd domain name ([domain/ADREALM.COM]). If it's not that, do you have some errors in /var/log/sssd/ files? – Christophe Drevet-Droguet Sep 6 '18 at 7:36
1

Finally I followed these instructions and suddenly it started working, its weird I still dont understand fully what was wrong: Manually Connecting an SSSD Client to an Active Directory Domain https://access.redhat.com/articles/3023951 .

I can now do id and su for an ActiveDir user on Centos7 like $ su user1@adrealm.com with ActiveDir password and login. Bottomline the /etc/hosts , /etc/krb5.conf, /etc/resolv.conf , /etc/sssd/sssd.conf, /etc/samba/smb.conf need to be carefully checked as all kinds of errors can happen.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.