Server is joined to abc.com and authentication is working to abc.com. A child domain was created a.abc.com but authentication is not working to the child domain.
sssd.conf [root@server01 sssd]# more /etc/sssd/sssd.conf [sssd] domains = abc.com config_file_version = 2 services = nss, pam [domain/abc.com] id_provider = ad access_provider = simple realmd_tags = manages-system joined-with-samba ad_domain = abc.com ad_server = dc01.abc.com,dc02.abc.com,_srv_ krb5_realm = ABC.COM default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = False fallback_homedir = /home/%u@%d simple_allow_groups = TDI Remote Access [email protected] debug_level = 0x07F0 [domain/a.abc.com] ad_server = sdc01.a.abc.com,sdc02.a.abc.com,_srv_ From krb5 log: (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.682973: Getting initial credentials for 017978\@[email protected] (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.683157: Sending request (217 bytes) to abc.com (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.683431: Sending initial UDP request to dgram x.x.161.251:88 (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746482: Received answer (129 bytes) from dgram x.x.161.251:88 (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746600: Response was from master KDC (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746660: Received error from KDC: -1765328316/Realm not local to KDC (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746708: Following referral to realm a.abc.com (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746788: Sending request (233 bytes) to a.abc.com (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.878092: Resolving hostname infsdcpci01.a.abc.com. (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.943098: Sending initial UDP request to dgram x.x.166.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.13629: Received answer (219 bytes) from dgram x.x.166.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.77982: Response was not from master KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78076: Received error from KDC: -1765328359/Additional pre-authentication required (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78145: Processing preauth types: 16, 15, 19, 2 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78192: Selected etype info: etype aes256-cts, salt "a.abc.com017978", params "" (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97413: AS key obtained for encrypted timestamp: aes256-cts/ED73 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97516: Encrypted timestamp (for 1485291543.976086): plain 301AA011180F32303137303132343230353930335AA10502030EE4D6, encrypted C7492B7309B4456330A7EE35DACBF67592D8573801102A3AB633823BE64F94EA7B1726E96F5EDAD9213AD0726D9CF89B214E96B1EB03B5AB (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97559: Preauth module encrypted_timestamp (2) (real) returned: 0/Success (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97583: Produced preauth for next request: 2 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97621: Sending request (313 bytes) to a.abc.com (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.230488: Resolving hostname infsdcpci02.a.abc.com. (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.297013: Sending initial UDP request to dgram x.x.166.252:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.366557: Received answer (186 bytes) from dgram x.x.166.252:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.428891: Response was not from master KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.428975: Received error from KDC: -1765328360/Preauthentication failed (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429029: Preauth tryagain input types: 16, 15, 19, 2 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429068: Retrying AS request with master KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429096: Getting initial credentials for 017978\@[email protected] (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429189: Sending request (217 bytes) to abc.com (master) (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429275: Sending initial UDP request to dgram x.x.161.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494276: Received answer (129 bytes) from dgram x.x.161.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494363: Received error from KDC: -1765328316/Realm not local to KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494397: Following referral to realm a.abc.com (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494467: Sending request (233 bytes) to a.abc.com (master) (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [get_and_save_tgt] (0x0020): 1234: [-1765328360][Preauthentication failed] (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [map_krb5_error] (0x0020): 1303: [-1765328360][Preauthentication failed] (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [k5c_send_data] (0x0200): Received error code 1432158215 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [pack_response_packet] (0x2000): response packet size: [4] (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [k5c_send_data] (0x4000): Response sent. (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [main] (0x0400): krb5_child completed successfully (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.682973: Getting initial credentials for 017978\@[email protected] (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.683157: Sending request (217 bytes) to abc.com (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.683431: Sending initial UDP request to dgram x.x.161.251:88 (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746482: Received answer (129 bytes) from dgram x.x.161.251:88 (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746600: Response was from master KDC (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746660: Received error from KDC: -1765328316/Realm not local to KDC (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746708: Following referral to realm a.abc.com (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746788: Sending request (233 bytes) to a.abc.com (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.878092: Resolving hostname infsdcpci01.a.abc.com. (Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.943098: Sending initial UDP request to dgram x.x.166.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.13629: Received answer (219 bytes) from dgram x.x.166.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.77982: Response was not from master KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78076: Received error from KDC: -1765328359/Additional pre-authentication required (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78145: Processing preauth types: 16, 15, 19, 2 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78192: Selected etype info: etype aes256-cts, salt "a.abc.com017978", params "" (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97413: AS key obtained for encrypted timestamp: aes256-cts/ED73 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97516: Encrypted timestamp (for 1485291543.976086): plain 301AA011180F32303137303132343230353930335AA10502030EE4D6, encrypted C7492B7309B4456330A7EE35DACBF67592D8573801102A3AB633823BE64F94EA7B1726E96F5EDAD9213AD0726D9CF89B214E96B1EB03B5AB (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97559: Preauth module encrypted_timestamp (2) (real) returned: 0/Success (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97583: Produced preauth for next request: 2 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97621: Sending request (313 bytes) to a.abc.com (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.230488: Resolving hostname infsdcpci02.a.abc.com. (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.297013: Sending initial UDP request to dgram x.x.166.252:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.366557: Received answer (186 bytes) from dgram x.x.166.252:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.428891: Response was not from master KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.428975: Received error from KDC: -1765328360/Preauthentication failed (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429029: Preauth tryagain input types: 16, 15, 19, 2 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429068: Retrying AS request with master KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429096: Getting initial credentials for 017978\@[email protected] (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429189: Sending request (217 bytes) to abc.com (master) (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429275: Sending initial UDP request to dgram x.x.161.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494276: Received answer (129 bytes) from dgram x.x.161.251:88 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494363: Received error from KDC: -1765328316/Realm not local to KDC (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494397: Following referral to realm a.abc.com (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494467: Sending request (233 bytes) to a.abc.com (master) (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [get_and_save_tgt] (0x0020): 1234: [-1765328360][Preauthentication failed] (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [map_krb5_error] (0x0020): 1303: [-1765328360][Preauthentication failed] (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [k5c_send_data] (0x0200): Received error code 1432158215 (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [pack_response_packet] (0x2000): response packet size: [4] (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [k5c_send_data] (0x4000): Response sent. (Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [main] (0x0400): krb5_child completed successfully From sssd domain log: (Tue Jan 24 13:59:18 2017) [sssd[be[a.hawaiian.aero]]] [be_req_set_domain] (0x0400): Changing request domain from [abc.com] to [a.abc.com] (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [be_pam_handler] (0x0100): Got request with the following data (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): domain: a.abc.com (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): user: [email protected] (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): service: conwrks (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): tty: (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): ruser: (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): rhost: (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): authtok type: 1 (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): newauthtok type: 0 (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): priv: 1 (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): cli_pid: 13206 (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): logon name: not set (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [krb5_auth_queue_send] (0x1000): Wait queue of user [[email protected]] is empty, running request [0x7f1aae523b70] immediately. (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [krb5_setup] (0x4000): No mapping for: [email protected] (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x7f1aae525c60 (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x7f1aae4e49f0 (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Running timer event 0x7f1aae525c60 "ltdb_callback" (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Destroying timer event 0x7f1aae4e49f0 "ltdb_timeout" (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Ending timer event 0x7f1aae525c60 "ltdb_callback" (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [krb5_auth_send] (0x0100): Home directory for user [[email protected]] not known. (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [get_server_status] (0x1000): Status of server 'dc01.abc.com' is 'working' (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'dc01.abc.com' is 'working' (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6 seconds (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [get_server_status] (0x1000): Status of server 'dc01.abc.com' is 'working' (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [be_resolve_server_process] (0x0200): Found address for server dc01.abc.com: [x.x.161.251] TTL 3600 (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [child_handler_setup] (0x2000): Setting up signal handler up for pid [25955] (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [child_handler_setup] (0x2000): Signal handler set up for pid [25955] (Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [write_pipe_handler] (0x0400): All data has been sent! (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [child_sig_handler] (0x1000): Waiting for child [25955]. (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [child_sig_handler] (0x0100): child [25955] finished successfully. (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [read_pipe_handler] (0x0400): EOF received, client finished (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [check_wait_queue] (0x1000): Wait queue for user [[email protected]] is empty. (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [krb5_auth_queue_done] (0x1000): krb5_auth_queue request [0x7f1aae523b70] done. (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 17, <NULL>) [Success (Failure setting user credentials)] (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [be_pam_handler_callback] (0x0100): Sending result [17][a.abc.com] (Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [be_pam_handler_callback] (0x0100): Sent result [17][a.abc.com] _______________________________________________ sssd-users mailing list -- [email protected] To unsubscribe send an email to [email protected]
