Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?

share|improve this question
up vote 8 down vote accepted

There are some tricky considerations to make everything works out-of-the-box. FreeBSD only supports sssd version 1.9.6 at this moment. So there's no support for Enterprise Principal Names.

If you have a domain with non matched UPNs it will fail to login, since the Kerberos authentication will fail during the process, even with FreeBSD supporting Enterprise Principal Names with Kerberos, the sssd cannot handle this case.

So in actual version of sssd you are limited to have the User Principal Name within the same Domain Name, for example:

Domain Name =
User Principal Name: sAMAccountName: username

Knowing this we can describe the steps to successfully authenticate users from AD in FreeBSD.

1. Configure Kerberos

Create the file /etc/krb5.conf with the following content:

    default_realm = EXAMPLE.COM
    dns_lookup_realm = true
    dns_lookup_kdc = true
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = yes

2. Install Samba 4.1 and configure it to join the Domain

Install Samba 4.1:

$ pkg install samba41

Create the file /usr/local/etc/smb4.conf with the following content:

    security = ads
    realm = EXAMPLE.COM
    workgroup = EXAMPLE

    kerberos method = secrets and keytab

    client signing = yes
    client use spnego = yes
    log file = /var/log/samba/%m.log

Ask for a Administrator Kerberos Ticket:

$ kinit Administrator

Then join the domain and create a keytab

$ net ads join createupn=host/ -k
$ net ads keytab create -k

3. Install the sssd package and Cyrus SASL with Kerberos support

Install required packages:

$ pkg install sssd cyrus-sasl-gssapi

Edit the file /usr/local/etc/sssd/sssd.conf to match this settings:

    config_file_version = 2
    services = nss, pam
    domains =



    # Uncomment if you need offline logins
    #cache_credentials = true

    id_provider = ad
    auth_provider = ad
    access_provider = ad
    chpass_provider = ad

    # Comment out if the users have the shell and home dir set on the AD side
    default_shell = /bin/tcsh
    fallback_homedir = /home/%u

    # Uncomment and adjust if the default principal SHORTNAME$@REALM is not available
    #ldap_sasl_mech = GSSAPI
    #ldap_sasl_authid = SERVER-HOSTNAME$@EXAMPLE.COM

4. Add sssd support to nsswitch.conf

Edit the file /etc/nsswitch.conf to match this settings:

group: files sss
passwd: files sss

5. Configure PAM to allow sssd authentication and handle home directory creation

Install optional packages for home directory creation:

$ pkg install pam_mkhomedir

Modify the necessary PAM realms to match this settings:

auth            sufficient      /usr/local/lib/
account         required        /usr/local/lib/        ignore_unknown_user
session         required        /usr/local/lib/  mode=0700
session         optional        /usr/local/lib/
password        sufficient      /usr/local/lib/        use_authtok

6. Switch to SASL enabled OpenLDAP Client

$ pkg remove -f openldap-client
$ pkg install openldap-sasl-client

7. Finally confirm that's everything is working

$ getent passwd <username>
share|improve this answer

Which Kerberos are you using here? The built-in one or security/krb5 from MIT?

When installing sssd, it requires that security/krb5 be installed which at this moment is still considered experimental in FreeBSD. Thus this question.

I am not having any luck getting the AD users/groups when executing 'getent' commands. it might be due to the fact that the NETBIOS name differs from the domain name -i.e. in my case, the domain name is and the NETBIOS name is DSP.

I configured only the pam.d login module. What other pam modules need to be edited in order for a successful authentication to take place?

Any additional info would be greatly appreciated!

share|improve this answer
I'm using the Heimdal Kerberos from the base. Not installing the MIT Kerberos port. – Vinícius Ferrão Apr 23 '15 at 16:21


This is a small update on using the sssd v1.11.7

​If you are using the "id_provider = ad​​"​​ and you see the following error in the sssd logfile: ​ /var/log/sssd/ (Sun Oct 5 18:41:37 2014) [sssd[be[]]] [sasl_bind_send] (0x0020): ldap_sasl_bind failed (-12)[Not Supported] (Sun Oct 5 18:41:37 2014) [sssd[be[]]] [sasl_bind_send] (0x0080): Extended failure message: [unknown error] ​

​You can use the following procedure to resolve this issue and make the AD integration work correctly. Now build sssd v1.11.7 with Samba support, building from src sssd is needed so its linked with libsasl2

​pkg remove samba41 pkg install cyrus-sasl-gssapi samba36-libsmbclient pam_mkhomedir ldb pkg remove -f openldap-client pkg install openldap-sasl-client cd /usr/ports/security/sssd && make install ​

share|improve this answer
What's the purpose of removing samba41? Does it only work with samba36? I'm having this exact problem but don't want to backrev to 3.6 if I don't have to. – MikeyB Mar 25 '15 at 1:41
You remove samba41 binary,then recompile samba41 from ports(is requested by sssd). In my case(a fresh 10.1 install) samba41 binary doesn't work,samba41 compiled by ports works perfectly – elbarna Jun 10 '15 at 3:33

Recompiling samba4 from ports is possible to use the winbind autentication like linux even without sssd. Simply recompile samba4 from ports after enable sasl ldap

    pkg remove samba41 
    pkg install cyrus-sasl-gssapi samba36-libsmbclient pam_mkhomedir ldb 
    pkg remove -f openldap-client 
    pkg install openldap-sasl-client 
    cd /usr/ports/security/sssd && make install

This will recompile samba with all support needed(gssapi,ldap,kerberos) then edit nsswitch.conf like this

passwd: files winbind
group: files winbind
share|improve this answer
Why use winbind and samba if we can use native Kerberos? – Vinícius Ferrão Jun 9 '15 at 22:44
For active directory users,kerberos is for password and sso – elbarna Jun 10 '15 at 3:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.