Linux SSSD with two AD DomainsCentOS 6 SSSD SSH/Console Login IssuesLinux / AD integration with SSSD: how to choose what systems a user can log into?Linux AD integration, unable to login when using Windows Server 2012 DC/var/log/secure reporting false positivesNot able to “Run As” any application on a server in the TRUSTING domain using an account from the TRUSTED domainSSSD on Centos, Active Directory search returns zero resultsCentos 7 SSSD based user access stops working after AD password changeUnable to add local user on system authenticating to ldap using sssdSSSD AD Integration - Clarification on Computer to join ADSSSD authenticate against parent domain
Can a magnetic field of a large body be stronger than its gravity?
Could a guilty Boris Johnson be used to cancel Brexit?
Why was it possible to cause an Apple //e to shut down with SHIFT and paddle button 2?
Short story written from alien perspective with this line: "It's too bright to look at, so they don't"
Working in the USA for living expenses only; allowed on VWP?
Chopin: marche funèbre bar 15 impossible place
Strange math syntax in old basic listing
What people are called boars ("кабан") and why?
What if you don't bring your credit card or debit for incidentals?
How can Iron Man's suit withstand this?
How can I make 20-200 ohm variable resistor look like a 20-240 ohm resistor?
How can a single Member of the House block a Congressional bill?
Incremental Ranges!
Is it OK to bring delicacies from hometown as tokens of gratitude for an out-of-town interview?
Is there a practical difference between different types of Berachos?
How do I remove hundreds of automatically added network printers?
Do adult Russians normally hand-write Cyrillic as cursive or as block letters?
Please help me identify this plane
Is the capacitor drawn or wired wrongly?
Restoring order in a deck of playing cards (II)
Setting extra bits in a bool makes it true and false at the same time
Is American Express widely accepted in France?
Sucuri detects malware on wordpress but I can't find the malicious code
Why does a helium balloon rise?
Linux SSSD with two AD Domains
CentOS 6 SSSD SSH/Console Login IssuesLinux / AD integration with SSSD: how to choose what systems a user can log into?Linux AD integration, unable to login when using Windows Server 2012 DC/var/log/secure reporting false positivesNot able to “Run As” any application on a server in the TRUSTING domain using an account from the TRUSTED domainSSSD on Centos, Active Directory search returns zero resultsCentos 7 SSSD based user access stops working after AD password changeUnable to add local user on system authenticating to ldap using sssdSSSD AD Integration - Clarification on Computer to join ADSSSD authenticate against parent domain
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I Joined my Centos Box to a Windows Active Directory Domain with
realm join --user=DomUser dom2.local
Without any Problems. The Domain hast a one-way Trust relationship to Dom1.
Our Windows Users can:
- Log-In with Dom1/User to Dom1/Host
- Log-In with Dom1/User to Dom2/Host
- Log-In with Dom2/User to Dom2/Host
On our Linux Boxes (in Dom2), only Dom2/Users can Log in. I found some evidence online, that sssd can be configured with two Domains, so i added a Block in the sssd config:
# cat /etc/sssd/sssd.conf
[sssd]
domains = dom1.local, dom2.local
config_file_version = 2
services = nss, pam
[domain/dom1.local]
ad_domain = dom1.local
krb5_realm = DOM1.LOCAL
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True
[domain/dom2.local]
ad_domain = dom2.local
krb5_realm = DOM2.LOCAL
realmd_tags = manages-system joined-with-samba
#cache_credentials = True
cache_credentials = False
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True
Now if i try to log in with a Dom2 User i get the following:
pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=host.dom1.local user=user@dom2.local
pam_sss(sshd:auth): received for user user@dom2.local: 6 (Permission denied)
Failed password for user@dom2.local from 10.10.0.10 port 34442 ssh2
Has someone succefully configured two AD Domains with sssd? Or any Idea how to do that?
Edit1:
With getent passwd i can see all users from both domains, and both:
id user1@dom1.local
id user2@dom2.local
work as well.
linux centos active-directory kerberos sssd
asked Sep 26 '17 at 14:46
embeddedembedded
374317
add a comment |
I Joined my Centos Box to a Windows Active Directory Domain with
realm join --user=DomUser dom2.local
Without any Problems. The Domain hast a one-way Trust relationship to Dom1.
Our Windows Users can:
- Log-In with Dom1/User to Dom1/Host
- Log-In with Dom1/User to Dom2/Host
- Log-In with Dom2/User to Dom2/Host
On our Linux Boxes (in Dom2), only Dom2/Users can Log in. I found some evidence online, that sssd can be configured with two Domains, so i added a Block in the sssd config:
# cat /etc/sssd/sssd.conf
[sssd]
domains = dom1.local, dom2.local
config_file_version = 2
services = nss, pam
[domain/dom1.local]
ad_domain = dom1.local
krb5_realm = DOM1.LOCAL
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True
[domain/dom2.local]
ad_domain = dom2.local
krb5_realm = DOM2.LOCAL
realmd_tags = manages-system joined-with-samba
#cache_credentials = True
cache_credentials = False
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True
Now if i try to log in with a Dom2 User i get the following:
pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=host.dom1.local user=user@dom2.local
pam_sss(sshd:auth): received for user user@dom2.local: 6 (Permission denied)
Failed password for user@dom2.local from 10.10.0.10 port 34442 ssh2
Has someone succefully configured two AD Domains with sssd? Or any Idea how to do that?
Edit1:
With getent passwd i can see all users from both domains, and both:
id user1@dom1.local
id user2@dom2.local
work as well.
linux centos active-directory kerberos sssd
asked Sep 26 '17 at 14:46
embeddedembedded
374317
add a comment |
I Joined my Centos Box to a Windows Active Directory Domain with
realm join --user=DomUser dom2.local
Without any Problems. The Domain hast a one-way Trust relationship to Dom1.
Our Windows Users can:
- Log-In with Dom1/User to Dom1/Host
- Log-In with Dom1/User to Dom2/Host
- Log-In with Dom2/User to Dom2/Host
On our Linux Boxes (in Dom2), only Dom2/Users can Log in. I found some evidence online, that sssd can be configured with two Domains, so i added a Block in the sssd config:
# cat /etc/sssd/sssd.conf
[sssd]
domains = dom1.local, dom2.local
config_file_version = 2
services = nss, pam
[domain/dom1.local]
ad_domain = dom1.local
krb5_realm = DOM1.LOCAL
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True
[domain/dom2.local]
ad_domain = dom2.local
krb5_realm = DOM2.LOCAL
realmd_tags = manages-system joined-with-samba
#cache_credentials = True
cache_credentials = False
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True
Now if i try to log in with a Dom2 User i get the following:
pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=host.dom1.local user=user@dom2.local
pam_sss(sshd:auth): received for user user@dom2.local: 6 (Permission denied)
Failed password for user@dom2.local from 10.10.0.10 port 34442 ssh2
Has someone succefully configured two AD Domains with sssd? Or any Idea how to do that?
Edit1:
With getent passwd i can see all users from both domains, and both:
id user1@dom1.local
id user2@dom2.local
work as well.
linux centos active-directory kerberos sssd
asked Sep 26 '17 at 14:46
embeddedembedded
374317
I Joined my Centos Box to a Windows Active Directory Domain with
realm join --user=DomUser dom2.local
Without any Problems. The Domain hast a one-way Trust relationship to Dom1.
Our Windows Users can:
- Log-In with Dom1/User to Dom1/Host
- Log-In with Dom1/User to Dom2/Host
- Log-In with Dom2/User to Dom2/Host
On our Linux Boxes (in Dom2), only Dom2/Users can Log in. I found some evidence online, that sssd can be configured with two Domains, so i added a Block in the sssd config:
# cat /etc/sssd/sssd.conf
[sssd]
domains = dom1.local, dom2.local
config_file_version = 2
services = nss, pam
[domain/dom1.local]
ad_domain = dom1.local
krb5_realm = DOM1.LOCAL
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True
[domain/dom2.local]
ad_domain = dom2.local
krb5_realm = DOM2.LOCAL
realmd_tags = manages-system joined-with-samba
#cache_credentials = True
cache_credentials = False
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True
Now if i try to log in with a Dom2 User i get the following:
pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=host.dom1.local user=user@dom2.local
pam_sss(sshd:auth): received for user user@dom2.local: 6 (Permission denied)
Failed password for user@dom2.local from 10.10.0.10 port 34442 ssh2
Has someone succefully configured two AD Domains with sssd? Or any Idea how to do that?
Edit1:
With getent passwd i can see all users from both domains, and both:
id user1@dom1.local
id user2@dom2.local
work as well.
linux centos active-directory kerberos sssd
linux centos active-directory kerberos sssd
asked Sep 26 '17 at 14:46
embeddedembedded
374317
asked Sep 26 '17 at 14:46
embeddedembedded
374317
edited Sep 26 '17 at 14:56
embedded
asked Sep 26 '17 at 14:46
embeddedembedded
374317
asked Sep 26 '17 at 14:46
embeddedembedded
374317
asked Sep 26 '17 at 14:46
embeddedembedded
374317
374317
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
You really need to enable sssd logs and look there, see https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html
Typically, PAM returns error 6 during auth when sssd switches to offline mode due to one of the servers being unreachable
answered Oct 7 '17 at 16:27
jhrozekjhrozek
1,10444
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f875568%2flinux-sssd-with-two-ad-domains%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You really need to enable sssd logs and look there, see https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html
Typically, PAM returns error 6 during auth when sssd switches to offline mode due to one of the servers being unreachable
answered Oct 7 '17 at 16:27
jhrozekjhrozek
1,10444
add a comment |
You really need to enable sssd logs and look there, see https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html
Typically, PAM returns error 6 during auth when sssd switches to offline mode due to one of the servers being unreachable
answered Oct 7 '17 at 16:27
jhrozekjhrozek
1,10444
add a comment |
You really need to enable sssd logs and look there, see https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html
Typically, PAM returns error 6 during auth when sssd switches to offline mode due to one of the servers being unreachable
answered Oct 7 '17 at 16:27
jhrozekjhrozek
1,10444
You really need to enable sssd logs and look there, see https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html
Typically, PAM returns error 6 during auth when sssd switches to offline mode due to one of the servers being unreachable
answered Oct 7 '17 at 16:27
jhrozekjhrozek
1,10444
answered Oct 7 '17 at 16:27
jhrozekjhrozek
1,10444
answered Oct 7 '17 at 16:27
jhrozekjhrozek
1,10444
answered Oct 7 '17 at 16:27
jhrozekjhrozek
1,10444
1,10444
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f875568%2flinux-sssd-with-two-ad-domains%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
