Hi,
You did not mention what SSSD version and what OS you are using.
I have few questions, see inline.
On 08/02/2017 10:59 AM, Tristan Bouillon wrote:
Hi
I have this case I'm working on and it's driving me crazy. I try to
setup something like this:
AD setup is like this with be-directional approbation:
- example.com
\-- chlld.example.com >
Have users registered in example.com => [email protected]
computers are registered in child.eample.com => [email protected]
I want to connect with user1 to server1 with ssh and sssd.
So, server1 is a Linux host, right? You can add it to the
child.example.com domain using 'realm join CHILD.EXAMPLE.COM'. It
will automatically add server1 to the child.example.com
domain (so it did not have to be there before).
Before any debug process I want to make sure this is possible because
i'm running in circle.
When setting up sssd et krb5 confs with child.example.com:
IF you set up SSSD manually there is a lot of room for errors,
I recommend using realm join and then just tweak the sssd.conf
in case something does not work the way you want.
-- sssd nss says: example.com is created as a subdomain of
child.example.com
This is OK. The 'subdomain' may be a little bit confusing, because this
refers to an internal C code structure that represents a trusted domain,
not an actual subdomain in the DNS sense. IIRC we changed the message
recently to be less confusing.
-- but AD backend is online for child.example.com and i can query it
You mean SSSD AD backend is running on the Linux host server1, right?
-- the query for [email protected] works great but the AD server in
child.example.com does not know the user and can't query his master AD
server.
I do not understand what you mean here. So, on the Linux host (server1),
if you query the [email protected], user info is returned. So what
operation on the Linux host is not working? (getent, su, ssh ... copy
paste the problematic commands and see our troubleshooting page).
When setting up sssd et krb5 confs with example.com
Again, realm join should set up everything for you. If you join the
EXAMPLE.COM realm then the server1 host will be added to the example.com
domain (you said you wanted them in the child.example.com, so I am
not sure if this what you want to do, but you can try it if it works
for you).
-- it attempts kinit with host/server1.child.example.com and fails
to get a tgt. AD is set to offline and it cannot query it.
When trying to mix up theses solutions I find something similar to the
cases above.
If it is possible can someone point me towards the configuration I'm
suppose to make.
Try using the realm join command from the Linux host to avoid hand
crafting the configuration. Note that the AD domain controller for
the domain you are joining to must be DNS resolvable from the Linux
host.
Don't know if it's the place but GG for the debugging options provides
with SSSD, it is clear and powerful.
_______________________________________________
sssd-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
_______________________________________________
sssd-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
