We found out it has to do with GPO. With
ad_gpo_access_control = enforcing
we get failures (system error 4 with no indication in the logs it was GPO in any way).
ad_gpo_access_control = permissive
and all is well. I’ll open a ticket with Canonical.
From: Andreas Hasenack [mailto:andreas@canonical.com]
Sent: Monday, December 18, 2017 2:48 PM
To: End-user discussions about the System Security Services Daemon <sssd-users@lists.fedorahosted.org>
Subject: [SSSD-users] Re: Ubuntu Xenial failures
EXTERNAL MAIL:
sssd-users-bounces@lists.fedorahosted.org
You should file a bug in Ubuntu, specially if downgrading to the previous package fixes the problem for you.
On Dec 18, 2017 18:10, "Jay McCanta" <J.McCanta@f5.com> wrote:
After an update to Ubuntu Xenial, sssd_pam always fails with a system error(4) error.
Dec 18 20:07:22 sv5cismfgcr01 sshd[27263]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.11.129 user=mccanta
Dec 18 20:07:22 sv5cismfgcr01 sshd[27263]: pam_sss(sshd:account): Access denied for user mccanta: 4 (System error)
I have debug_level 10 logs I can send. Didn't want to post thos to the mailing list.
Jay
_______________________________________________
sssd-users mailing list -- sssd-users@lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org