On 01/24/2017 05:06 PM, [email protected] wrote:
Server is joined to abc.com and authentication is working to abc.com. A child
domain was created a.abc.com but authentication is not working to the child
domain.
sssd.conf
[root@server01 sssd]# more /etc/sssd/sssd.conf
[sssd]
domains = abc.com
config_file_version = 2
services = nss, pam
[domain/abc.com]
id_provider = ad
access_provider = simple
realmd_tags = manages-system joined-with-samba
ad_domain = abc.com
ad_server = dc01.abc.com,dc02.abc.com,_srv_
krb5_realm = ABC.COM
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%u@%d
simple_allow_groups = TDI Remote Access [email protected]
debug_level = 0x07F0
[domain/a.abc.com]
ad_server = sdc01.a.abc.com,sdc02.a.abc.com,_srv_
From krb5 log:
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.682973: Getting initial
credentials for 017978\@[email protected]
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.683157: Sending request
(217 bytes) to abc.com
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.683431: Sending initial
UDP request to dgram x.x.161.251:88
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746482: Received answer
(129 bytes) from dgram x.x.161.251:88
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746600: Response was
from master KDC
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746660: Received error
from KDC: -1765328316/Realm not local to KDC
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746708: Following
referral to realm a.abc.com
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746788: Sending request
(233 bytes) to a.abc.com
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.878092: Resolving
hostname infsdcpci01.a.abc.com.
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.943098: Sending initial
UDP request to dgram x.x.166.251:88
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.13629: Received answer
(219 bytes) from dgram x.x.166.251:88
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.77982: Response was not
from master KDC
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78076: Received error
from KDC: -1765328359/Additional pre-authentication required
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78145: Processing
preauth types: 16, 15, 19, 2
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955]
1485291559.78192: Selected etype info: etype aes256-cts, salt "a.abc.com017978", params
""
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97413: AS key obtained
for encrypted timestamp: aes256-cts/ED73
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97516: Encrypted
timestamp (for 1485291543.976086): plain
301AA011180F32303137303132343230353930335AA10502030EE4D6, encrypted
C7492B7309B4456330A7EE35DACBF67592D8573801102A3AB633823BE64F94EA7B1726E96F5EDAD9213AD0726D9CF89B214E96B1EB03B5AB
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97559: Preauth module
encrypted_timestamp (2) (real) returned: 0/Success
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97583: Produced preauth
for next request: 2
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97621: Sending request
(313 bytes) to a.abc.com
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.230488: Resolving
hostname infsdcpci02.a.abc.com.
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.297013: Sending initial
UDP request to dgram x.x.166.252:88
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.366557: Received answer
(186 bytes) from dgram x.x.166.252:88
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.428891: Response was not
from master KDC
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.428975: Received error
from KDC: -1765328360/Preauthentication failed
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429029: Preauth tryagain
input types: 16, 15, 19, 2
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429068: Retrying AS
request with master KDC
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429096: Getting initial
credentials for 017978\@[email protected]
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429189: Sending request
(217 bytes) to abc.com (master)
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429275: Sending initial
UDP request to dgram x.x.161.251:88
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494276: Received answer
(129 bytes) from dgram x.x.161.251:88
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494363: Received error
from KDC: -1765328316/Realm not local to KDC
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494397: Following
referral to realm a.abc.com
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494467: Sending request
(233 bytes) to a.abc.com (master)
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [get_and_save_tgt]
(0x0020): 1234: [-1765328360][Preauthentication failed]
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [map_krb5_error]
(0x0020): 1303: [-1765328360][Preauthentication failed]
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [k5c_send_data]
(0x0200): Received error code 1432158215
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [pack_response_packet]
(0x2000): response packet size: [4]
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [k5c_send_data]
(0x4000): Response sent.
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [main] (0x0400):
krb5_child completed successfully
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.682973: Getting initial
credentials for 017978\@[email protected]
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.683157: Sending request
(217 bytes) to abc.com
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.683431: Sending initial
UDP request to dgram x.x.161.251:88
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746482: Received answer
(129 bytes) from dgram x.x.161.251:88
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746600: Response was
from master KDC
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746660: Received error
from KDC: -1765328316/Realm not local to KDC
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746708: Following
referral to realm a.abc.com
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.746788: Sending request
(233 bytes) to a.abc.com
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.878092: Resolving
hostname infsdcpci01.a.abc.com.
(Tue Jan 24 13:59:18 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291558.943098: Sending initial
UDP request to dgram x.x.166.251:88
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.13629: Received answer
(219 bytes) from dgram x.x.166.251:88
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.77982: Response was not
from master KDC
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78076: Received error
from KDC: -1765328359/Additional pre-authentication required
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.78145: Processing
preauth types: 16, 15, 19, 2
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [sss_child_krb5_trace_cb] (0x4000): [25955]
1485291559.78192: Selected etype info: etype aes256-cts, salt "a.abc.com017978", params
""
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97413: AS key obtained
for encrypted timestamp: aes256-cts/ED73
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97516: Encrypted
timestamp (for 1485291543.976086): plain
301AA011180F32303137303132343230353930335AA10502030EE4D6, encrypted
C7492B7309B4456330A7EE35DACBF67592D8573801102A3AB633823BE64F94EA7B1726E96F5EDAD9213AD0726D9CF89B214E96B1EB03B5AB
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97559: Preauth module
encrypted_timestamp (2) (real) returned: 0/Success
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97583: Produced preauth
for next request: 2
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.97621: Sending request
(313 bytes) to a.abc.com
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.230488: Resolving
hostname infsdcpci02.a.abc.com.
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.297013: Sending initial
UDP request to dgram x.x.166.252:88
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.366557: Received answer
(186 bytes) from dgram x.x.166.252:88
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.428891: Response was not
from master KDC
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.428975: Received error
from KDC: -1765328360/Preauthentication failed
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429029: Preauth tryagain
input types: 16, 15, 19, 2
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429068: Retrying AS
request with master KDC
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429096: Getting initial
credentials for 017978\@[email protected]
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429189: Sending request
(217 bytes) to abc.com (master)
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.429275: Sending initial
UDP request to dgram x.x.161.251:88
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494276: Received answer
(129 bytes) from dgram x.x.161.251:88
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494363: Received error
from KDC: -1765328316/Realm not local to KDC
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494397: Following
referral to realm a.abc.com
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]]
[sss_child_krb5_trace_cb] (0x4000): [25955] 1485291559.494467: Sending request
(233 bytes) to a.abc.com (master)
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [get_and_save_tgt]
(0x0020): 1234: [-1765328360][Preauthentication failed]
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [map_krb5_error]
(0x0020): 1303: [-1765328360][Preauthentication failed]
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [k5c_send_data]
(0x0200): Received error code 1432158215
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [pack_response_packet]
(0x2000): response packet size: [4]
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [k5c_send_data]
(0x4000): Response sent.
(Tue Jan 24 13:59:19 2017) [[sssd[krb5_child[25955]]]] [main] (0x0400):
krb5_child completed successfully
From sssd domain log:
(Tue Jan 24 13:59:18 2017) [sssd[be[a.hawaiian.aero]]] [be_req_set_domain]
(0x0400): Changing request domain from [abc.com] to [a.abc.com]
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [be_pam_handler] (0x0100): Got
request with the following data
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100):
command: PAM_AUTHENTICATE
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100):
domain: a.abc.com
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): user:
[email protected]
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100):
service: conwrks
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): tty:
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): ruser:
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): rhost:
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100):
authtok type: 1
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100):
newauthtok type: 0
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): priv:
1
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100):
cli_pid: 13206
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [pam_print_data] (0x0100): logon
name: not set
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [krb5_auth_queue_send] (0x1000):
Wait queue of user [[email protected]] is empty, running request
[0x7f1aae523b70] immediately.
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [krb5_setup] (0x4000): No
mapping for: [email protected]
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Added timed event
"ltdb_callback": 0x7f1aae525c60
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Added timed event
"ltdb_timeout": 0x7f1aae4e49f0
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Running timer event
0x7f1aae525c60 "ltdb_callback"
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Destroying timer event
0x7f1aae4e49f0 "ltdb_timeout"
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [ldb] (0x4000): Ending timer event
0x7f1aae525c60 "ltdb_callback"
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [krb5_auth_send] (0x0100): Home
directory for user [[email protected]] not known.
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [fo_resolve_service_send]
(0x0100): Trying to resolve service 'AD'
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [get_server_status] (0x1000):
Status of server 'dc01.abc.com' is 'working'
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [get_port_status] (0x1000): Port
status of port 389 for server 'dc01.abc.com' is 'working'
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]]
[fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6 seconds
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [resolve_srv_send] (0x0200): The
status of SRV lookup is resolved
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [get_server_status] (0x1000):
Status of server 'dc01.abc.com' is 'working'
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [be_resolve_server_process]
(0x1000): Saving the first resolved server
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [be_resolve_server_process]
(0x0200): Found address for server dc01.abc.com: [x.x.161.251] TTL 3600
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [child_handler_setup] (0x2000):
Setting up signal handler up for pid [25955]
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [child_handler_setup] (0x2000):
Signal handler set up for pid [25955]
(Tue Jan 24 13:59:18 2017) [sssd[be[abc.com]]] [write_pipe_handler] (0x0400):
All data has been sent!
(Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [child_sig_handler] (0x1000):
Waiting for child [25955].
(Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [child_sig_handler] (0x0100):
child [25955] finished successfully.
(Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [read_pipe_handler] (0x0400):
EOF received, client finished
(Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [check_wait_queue] (0x1000):
Wait queue for user [[email protected]] is empty.
(Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [krb5_auth_queue_done] (0x1000):
krb5_auth_queue request [0x7f1aae523b70] done.
(Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [be_pam_handler_callback] (0x0100):
Backend returned: (0, 17, <NULL>) [Success (Failure setting user credentials)]
(Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [be_pam_handler_callback]
(0x0100): Sending result [17][a.abc.com]
(Tue Jan 24 13:59:19 2017) [sssd[be[abc.com]]] [be_pam_handler_callback]
(0x0100): Sent result [17][a.abc.com]
The main error to focus on is the 'Realm not local to KDC' error in the
krb5_child.log leading to failed authentication.
Can you check if you have 'dns_lookup_kdc = true' set in /etc/krb5.conf?
Also, SSSD will automatically discover trusted domains for trusted
domains in the same forest therefore you do not need another domain
section in sssd.conf:
> [domain/a.abc.com]
> ad_server = sdc01.a.abc.com,sdc02.a.abc.com,_srv_
These lines were likely ignored by SSSD because you only had specified
the single domain for the 'domains' option:
> domains = abc.com
Kind regards,
Justin Stephenson
_______________________________________________
sssd-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
_______________________________________________
sssd-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
