I'm new to SSSD and I try to connect SSSD to my AD to manage SSH access.
I set up the attribute and class on AD schema master and I can fill
keys using ADUC.
I've also enabled the checkbox for GC sync. My client system is debian buster.

I've joined a machine this way:
realm discover EXAMPLE.COM
realm join EXAMPLE.COM

My /etc/sssd/sssd.conf:
domains = example.com
services = nss, sudo, ssh, pam, autofs
config_file_version = 2
debug_level = 9

debug_level = 9
ssh_use_certificate_keys = false

debug_level = 9
ad_domain = example.com
krb5_realm = example.com
realmd_tags = manages-system joined-with-adcli
cache_credentials = False
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%u@%d
access_provider = simple
simple_allow_groups = domänen-benutzer

SSHD config contains:
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
AuthorizedKeysCommandUser nobody

I can successfully login using my AD account using my password. This
works flawless.
When I try to retrieve my SSH keys, it does not work:
root@slde0009 ~ # sss_ssh_authorizedkeys --debug 9 kolbrich
root@slde0009 ~ #

Passwd works:
root@slde0009 ~ # getent passwd kolbrich

sssd_example.com.log contains:
(Wed Mar 25 14:36:53 2020) [sssd[be[example.com]]]
[sdap_attrs_add_ldap_attr] (0x2000): sshPublicKey is not available for

LDAP looks fine:
root@slde0009 ~ # ldapsearch -H ldap:// -D
administra...@example.com -b "dc=example,dc=com" -W -x
'(objectClass=ldapPublicKey)' 'sshPublicKey'
# Kevin Olbrich, Users, DIT, MyBusiness, example.com
dn: CN=Kevin Olbrich,OU=Users,OU=DIT,OU=MyBusiness,DC=example,DC=com
sshPublicKey: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClO6Jdbj7HffLDmAoXr/KU7IYn
 v3rGErCL k...@sv01.de

There are some howtos for this scenario but they work at this point :-P

What am I doing wrong here?

Thank you in advance!

Kind regards
sssd-users mailing list -- sssd-users@lists.fedorahosted.org
To unsubscribe send an email to sssd-users-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 

Reply via email to