[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-31 Thread Andreas Hasenack
> On Ubuntu I changed the configuration of the resolver in /etc/resolv.conf > to use the DNS directly instead of the local systemd-resolved from > "nameserver 127.0.0.53" to "nameserver 10.148.231.1" and it fixes the issue. Could you also check what the status of the systemd resolver was? sudo sy

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-31 Thread Andreas Hasenack
I've seen in the freeipa install docs that freeipa expects `hostname` to return the FQDN of the host, and not just the hostname. I always found that odd. Maybe this is what's needed here. Try setting /etc/hostname to the fqdn, with the domain part. Then test with `hostname` and `hostname -f` and bo

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-31 Thread Jean-Baptiste Lallement
On Ubuntu I changed the configuration of the resolver in /etc/resolv.conf to use the DNS directly instead of the local systemd- resolved from "nameserver 127.0.0.53" to "nameserver 10.148.231.1" and it fixes the issue. This narrows down the issue to a name resolution problem. -- You received thi

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-31 Thread Jean-Baptiste Lallement
Doing a reverse DNS lookup on Ubuntu returns: root@adclient01:~# host 192.168.122.250 250.122.168.192.in-addr.arpa domain name pointer adc01. While on Fedora is returns the name with the domain: root@localhost-live ~]# host 192.168.122.250 250.122.168.192.in-addr.arpa domain name pointer adc01. 25

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-31 Thread Jean-Baptiste Lallement
With debugging enabled, we see that the domain is marked offline. # sssctl domain-list warthogs.biz # sssctl domain-status warthogs.biz Online status: Offline Active servers: AD Global Catalog: not connected AD Domain Controller: adc01.warthogs.biz Discovered AD Global Catalog servers: - adc01.

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-31 Thread Jean-Baptiste Lallement
Thanks for looking into this. Testing is done in VMs, using dnsmasq for name resolution. I set use_fully_qualified_names = False because I suspect a name resolution issue, and wanted to try another setting than the default set when the configuration file is created by realm. True or False doesn't

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-28 Thread Andreas Hasenack
** Changed in: sssd (Ubuntu) Status: New => Triaged ** Changed in: sssd (Ubuntu) Assignee: (unassigned) => Andreas Hasenack (ahasenack) ** Changed in: sssd (Ubuntu) Importance: Undecided => Medium -- You received this bug notification because you are a member of Ubuntu Bugs, whic

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-28 Thread Andreas Hasenack
I repeated it with focal, and right after the join, id user@ worked, and I have no /etc/krb5.conf. There must be something else going on over there. Can you please make these changes: - sudo apt install sssd-dbug (if not already installed) - /etc/sssd/sssd.conf: [sssd] services = nss, pam, ifp <-

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-28 Thread Andreas Hasenack
Finally, just in case you were using it, lxd is not the best test environment for this, because of the high uids chosen by sssd which fall outside the range set in /etc/subuid and /etc/subgid. A VM is best to avoid headaches and hard-to-debug issues. -- You received this bug notification because

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-28 Thread Andreas Hasenack
Hm, sorry, I tried on bionic, I don't know why. Trying again on focal and groovy too. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1893438 Title: Cannot resolve users without an existing /etc/krb5.

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-28 Thread Andreas Hasenack
Also, do you get a /etc/krb5.conf created when using realm to join the domain on fedora? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1893438 Title: Cannot resolve users without an existing /etc/kr

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-28 Thread Andreas Hasenack
I repeated the steps in a bionic lxd container. I had to install packagekit, which you already have on a desktop, but in the end it's working, and I have no /etc/krb5.conf file at all: ubuntu@bionic-sssd-desktop-team:~$ id j...@ad1.example.com uid=1725801106(j...@ad1.example.com) gid=1725800513(do

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-28 Thread Andreas Hasenack
Taking a look -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1893438 Title: Cannot resolve users without an existing /etc/krb5.conf To manage notifications about this bug go to: https://bugs.launchp

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-28 Thread Jean-Baptiste Lallement
** Description changed: Tested on Ubuntu Desktop 20.04.1 and Groovy up-to-date. The setup in one ADC running on Windows Server 2019 and 3 clients, Ubuntu Desktop 20.04.1, Ubuntu Deskop Groovy, Fedora 32. On Ubuntu clients, after following the documentation at https://discourse.ubun

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-28 Thread Jean-Baptiste Lallement
** Attachment added: "sssd.logs.tgz" https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1893438/+attachment/5405445/+files/sssd.logs.tgz -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1893438 Titl

[Bug 1893438] Re: Cannot resolve users without an existing /etc/krb5.conf

2020-08-28 Thread Jean-Baptiste Lallement
** Attachment added: "sssd.conf" https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1893438/+attachment/5405446/+files/sssd.conf -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1893438 Title: Can