I can switch to the mentioned domain user with su command from the server, but ssh login is failing. The user domain group is already added in sssd.conf file under "simple_allow_groups"
The errors in /var/log/secure appear as follows:
Jan 18 04:10:18 m1-vlp0006 sshd: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.35.x.x user=postl\u522660 Jan 18 04:10:18 m1-vlp0006 sshd: pam_sss(sshd:account): Access denied for user postl\u522660: 6 (Permission denied) Jan 18 04:10:18 m1-vlp0006 sshd: Failed password for postl\\u522660 from 138.35.x.x port 57903 ssh2 Jan 18 04:10:18 m1-vlp0006 sshd: fatal: Access denied for user postl\\\\u522660 by PAM account configuration [preauth]
Understood that , it says failed passwd. But in real it is not the case, I am able to login to other windows machine with that domain user successfully. Same credentials I am entering here as well. So my input credentials are correct, but not sure why it is showing like that. Further I can see a authentication success initially , but end up with access Denied. Is there any configuration missing to allow a particular AD user or group to permit login to this server, other than adding corresponding group of that user to "simple_allow_groups"
configuration looks like below:
[email@example.com ~]# realm list --all POSTLl.xxxx.xxx type: kerberos realm-name: POSTL.xxxx.xxx domain-name: POSTL.xxxx.xxx configured: kerberos-member server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common-tools login-formats: %U@POSTL.xxxx.xxx login-policy: allow-permitted-logins permitted-logins: permitted-groups: gu-adm-infra-unix-systems, gu-adm-esm%unix, gu-adm-epicon, domain%users