10:05 a.m.
Hi all,
I'm trying to configure SSSD to access several domains at the same time and
I'm not able to achieve that.
The two domains are A.DOMAIN.TLD and B.DOMAIN.TLD.
Using that krb5.conf I can't retrieve any user from any domain:
---------------------------
[libdefaults]
default_realm = A.DOMAIN.TLD
dns_lookup_realm = true
dns_lookup_kdc = true
rdns_lookup_kdc = false
realm_try_domains = 0
[realms]
A.DOMAIN.TLD = {
default_domain = A.DOMAIN.TLD
}
B.DOMAIN.TLD = {
default_domain = B.DOMAIN.TLD
}
[domain_realm]
.a.domain.tld = .A.DOMAIN.TLD
a.domain.tld = A.DOMAIN.TLD
.b.domain.tld = .B.DOMAIN.TLD
b.domain.tld = B.DOMAIN.TLD
-----------------------------
Using this krb5.conf I can retrieve users from A.DOMAIN.TLD:
---------------------------
[libdefaults]
default_realm = A.DOMAIN.TLD
dns_lookup_realm = true
dns_lookup_kdc = true
rdns_lookup_kdc = false
---------------------------
And the sssd.conf is in both cases:
---------------------------
[sssd]
services = nss, pam
config_file_version = 2
domains = a.domain.tld, b.domain.tld
[nss]
[pam]
[domain/a.domain.tld]
id_provider = ldap
ldap_schema = rfc2307bis
ldap_referrals = false
ldap_uri = ldap://adc.a.domain.tld
ldap_search_base = dc=A,dc=DOMAIN,dc=TLD
ldap_force_upper_case_realm = true
# See man sssd-simple
access_provider = simple
# Uncomment to check for account expiration in DC
# access_provider = ldap
# ldap_access_order = expire
# ldap_account_expire_policy = ad
# Enumeration is discouraged for performance reasons.
# enumerate = true
auth_provider = krb5
chpass_provider = krb5
ldap_sasl_mech = gssapi
ldap_sasl_authid = adc$(a)A.DOMAIN.TLD
krb5_realm = A.DOMAIN.TLD
krb5_server = adc.a.domain.tld
krb5_kpasswd = adc.a.domain.tld
ldap_krb5_keytab = /etc/krb5.sssd_multi.keytab
ldap_user_object_class = user
#ldap_user_name = sAMAccountName
ldap_user_name = userPrincipalName
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_user_shell = loginShell
ldap_group_object_class = group
[domain/b.domain.tld]
id_provider = ldap
ldap_schema = rfc2307bis
ldap_referrals = false
ldap_uri = ldap://bdc.b.domain.tld
ldap_search_base = dc=B,dc=DOMAIN,dc=TLD
ldap_force_upper_case_realm = true
# See man sssd-simple
access_provider = simple
# Uncomment to check for account expiration in DC
# access_provider = ldap
# ldap_access_order = expire
# ldap_account_expire_policy = ad
# Enumeration is discouraged for performance reasons.
# enumerate = true
auth_provider = krb5
chpass_provider = krb5
ldap_sasl_mech = gssapi
ldap_sasl_authid = bdc$(a)B.DOMAIN.TLD
krb5_realm = B.DOMAIN.TLD
krb5_server = dc.b.domain.tld
krb5_kpasswd = dc.b.domain.tld
ldap_krb5_keytab = /etc/krb5.sssd_multi.keytab
ldap_user_object_class = user
#ldap_user_name = sAMAccountName
ldap_user_name = userPrincipalName
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_user_shell = loginShell
ldap_group_object_class = group
---------------------------
Best regards,
mathias