Otdfbt

Can a magnetic field of a large body be stronger than its gravity?

Could a guilty Boris Johnson be used to cancel Brexit?

Why was it possible to cause an Apple //e to shut down with SHIFT and paddle button 2?

Short story written from alien perspective with this line: "It's too bright to look at, so they don't"

Working in the USA for living expenses only; allowed on VWP?

Chopin: marche funèbre bar 15 impossible place

Strange math syntax in old basic listing

What people are called boars ("кабан") and why?

What if you don't bring your credit card or debit for incidentals?

How can Iron Man's suit withstand this?

How can I make 20-200 ohm variable resistor look like a 20-240 ohm resistor?

How can a single Member of the House block a Congressional bill?

Incremental Ranges!

Is it OK to bring delicacies from hometown as tokens of gratitude for an out-of-town interview?

Is there a practical difference between different types of Berachos?

How do I remove hundreds of automatically added network printers?

Do adult Russians normally hand-write Cyrillic as cursive or as block letters?

Please help me identify this plane

Is the capacitor drawn or wired wrongly?

Restoring order in a deck of playing cards (II)

Setting extra bits in a bool makes it true and false at the same time

Is American Express widely accepted in France?

Sucuri detects malware on wordpress but I can't find the malicious code

Why does a helium balloon rise?

Linux SSSD with two AD Domains

CentOS 6 SSSD SSH/Console Login IssuesLinux / AD integration with SSSD: how to choose what systems a user can log into?Linux AD integration, unable to login when using Windows Server 2012 DC/var/log/secure reporting false positivesNot able to “Run As” any application on a server in the TRUSTING domain using an account from the TRUSTED domainSSSD on Centos, Active Directory search returns zero resultsCentos 7 SSSD based user access stops working after AD password changeUnable to add local user on system authenticating to ldap using sssdSSSD AD Integration - Clarification on Computer to join ADSSSD authenticate against parent domain

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

0

1

I Joined my Centos Box to a Windows Active Directory Domain with

realm join --user=DomUser dom2.local

Without any Problems. The Domain hast a one-way Trust relationship to Dom1.
Our Windows Users can:

• Log-In with Dom1/User to Dom1/Host


• Log-In with Dom1/User to Dom2/Host


• Log-In with Dom2/User to Dom2/Host

On our Linux Boxes (in Dom2), only Dom2/Users can Log in. I found some evidence online, that sssd can be configured with two Domains, so i added a Block in the sssd config:

# cat /etc/sssd/sssd.conf 
[sssd]
domains = dom1.local, dom2.local
config_file_version = 2
services = nss, pam

[domain/dom1.local]
ad_domain = dom1.local
krb5_realm = DOM1.LOCAL
realmd_tags = manages-system joined-with-samba 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True


[domain/dom2.local]
ad_domain = dom2.local
krb5_realm = DOM2.LOCAL
realmd_tags = manages-system joined-with-samba 
#cache_credentials = True
cache_credentials = False
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True

Now if i try to log in with a Dom2 User i get the following:

pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=host.dom1.local user=user@dom2.local
pam_sss(sshd:auth): received for user user@dom2.local: 6 (Permission denied)
Failed password for user@dom2.local from 10.10.0.10 port 34442 ssh2

Has someone succefully configured two AD Domains with sssd? Or any Idea how to do that?

Edit1:

With getent passwd i can see all users from both domains, and both:

id user1@dom1.local
id user2@dom2.local

work as well.

linux centos active-directory kerberos sssd

share|improve this question

edited Sep 26 '17 at 14:56

embedded

asked Sep 26 '17 at 14:46

embeddedembedded

374317

add a comment | 

0

1

I Joined my Centos Box to a Windows Active Directory Domain with

realm join --user=DomUser dom2.local

Without any Problems. The Domain hast a one-way Trust relationship to Dom1.
Our Windows Users can:

• Log-In with Dom1/User to Dom1/Host


• Log-In with Dom1/User to Dom2/Host


• Log-In with Dom2/User to Dom2/Host

On our Linux Boxes (in Dom2), only Dom2/Users can Log in. I found some evidence online, that sssd can be configured with two Domains, so i added a Block in the sssd config:

# cat /etc/sssd/sssd.conf 
[sssd]
domains = dom1.local, dom2.local
config_file_version = 2
services = nss, pam

[domain/dom1.local]
ad_domain = dom1.local
krb5_realm = DOM1.LOCAL
realmd_tags = manages-system joined-with-samba 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True


[domain/dom2.local]
ad_domain = dom2.local
krb5_realm = DOM2.LOCAL
realmd_tags = manages-system joined-with-samba 
#cache_credentials = True
cache_credentials = False
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True

Now if i try to log in with a Dom2 User i get the following:

pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=host.dom1.local user=user@dom2.local
pam_sss(sshd:auth): received for user user@dom2.local: 6 (Permission denied)
Failed password for user@dom2.local from 10.10.0.10 port 34442 ssh2

Has someone succefully configured two AD Domains with sssd? Or any Idea how to do that?

Edit1:

With getent passwd i can see all users from both domains, and both:

id user1@dom1.local
id user2@dom2.local

work as well.

linux centos active-directory kerberos sssd

share|improve this question

edited Sep 26 '17 at 14:56

embedded

asked Sep 26 '17 at 14:46

embeddedembedded

374317

add a comment | 

I Joined my Centos Box to a Windows Active Directory Domain with

realm join --user=DomUser dom2.local

Without any Problems. The Domain hast a one-way Trust relationship to Dom1.
Our Windows Users can:

• Log-In with Dom1/User to Dom1/Host


• Log-In with Dom1/User to Dom2/Host


• Log-In with Dom2/User to Dom2/Host

On our Linux Boxes (in Dom2), only Dom2/Users can Log in. I found some evidence online, that sssd can be configured with two Domains, so i added a Block in the sssd config:

# cat /etc/sssd/sssd.conf 
[sssd]
domains = dom1.local, dom2.local
config_file_version = 2
services = nss, pam

[domain/dom1.local]
ad_domain = dom1.local
krb5_realm = DOM1.LOCAL
realmd_tags = manages-system joined-with-samba 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True


[domain/dom2.local]
ad_domain = dom2.local
krb5_realm = DOM2.LOCAL
realmd_tags = manages-system joined-with-samba 
#cache_credentials = True
cache_credentials = False
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True

Now if i try to log in with a Dom2 User i get the following:

pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=host.dom1.local user=user@dom2.local
pam_sss(sshd:auth): received for user user@dom2.local: 6 (Permission denied)
Failed password for user@dom2.local from 10.10.0.10 port 34442 ssh2

Has someone succefully configured two AD Domains with sssd? Or any Idea how to do that?

Edit1:

With getent passwd i can see all users from both domains, and both:

id user1@dom1.local
id user2@dom2.local

work as well.

linux centos active-directory kerberos sssd

share|improve this question

edited Sep 26 '17 at 14:56

embedded

asked Sep 26 '17 at 14:46

embeddedembedded

374317

realm join --user=DomUser dom2.local

# cat /etc/sssd/sssd.conf 
[sssd]
domains = dom1.local, dom2.local
config_file_version = 2
services = nss, pam

[domain/dom1.local]
ad_domain = dom1.local
krb5_realm = DOM1.LOCAL
realmd_tags = manages-system joined-with-samba 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True


[domain/dom2.local]
ad_domain = dom2.local
krb5_realm = DOM2.LOCAL
realmd_tags = manages-system joined-with-samba 
#cache_credentials = True
cache_credentials = False
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
enumerate = True

pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=host.dom1.local user=user@dom2.local
pam_sss(sshd:auth): received for user user@dom2.local: 6 (Permission denied)
Failed password for user@dom2.local from 10.10.0.10 port 34442 ssh2

id user1@dom1.local
id user2@dom2.local

share|improve this question

edited Sep 26 '17 at 14:56

embedded

asked Sep 26 '17 at 14:46

embeddedembedded

374317

share|improve this question

edited Sep 26 '17 at 14:56

embedded

asked Sep 26 '17 at 14:46

embeddedembedded

374317

asked Sep 26 '17 at 14:46

embeddedembedded

374317

asked Sep 26 '17 at 14:46

embeddedembedded

374317

1 Answer
1

active

oldest

votes

0

You really need to enable sssd logs and look there, see https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html

Typically, PAM returns error 6 during auth when sssd switches to offline mode due to one of the servers being unreachable

share|improve this answer

answered Oct 7 '17 at 16:27

jhrozekjhrozek

1,10444

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f875568%2flinux-sssd-with-two-ad-domains%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

You really need to enable sssd logs and look there, see https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html

Typically, PAM returns error 6 during auth when sssd switches to offline mode due to one of the servers being unreachable

share|improve this answer

answered Oct 7 '17 at 16:27

jhrozekjhrozek

1,10444

add a comment | 

0

You really need to enable sssd logs and look there, see https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html

Typically, PAM returns error 6 during auth when sssd switches to offline mode due to one of the servers being unreachable

share|improve this answer

answered Oct 7 '17 at 16:27

jhrozekjhrozek

1,10444

add a comment | 

You really need to enable sssd logs and look there, see https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html

Typically, PAM returns error 6 during auth when sssd switches to offline mode due to one of the servers being unreachable

share|improve this answer

answered Oct 7 '17 at 16:27

jhrozekjhrozek

1,10444

share|improve this answer

answered Oct 7 '17 at 16:27

jhrozekjhrozek

1,10444

answered Oct 7 '17 at 16:27

jhrozekjhrozek

1,10444

answered Oct 7 '17 at 16:27

jhrozekjhrozek

1,10444