2

Hi have a Ubuntu box setup to login to AD.

I can login to AD using usernames that do not match local usernames however I have a local username that also exists in AD and I want to be able to login to AD as that user.

I have tried user@domain and DOMAIN\user but neither works. If I login using "user" without any domain then it logs in locally.

/etc/sssd/sssd.conf

[sssd]
services = nss, pam
config_file_version = 2
domains = AD.HERE.COM.AU

[domain/AD.HERE.COM.AU]
id_provider = ad
access_provider = ad

# Use this if users are being logged in at /.
# This example specifies /home/DOMAIN-FQDN/user as $HOME.  Use with pam_mkhomedir.so
override_homedir = /home/%d/%u

# Uncomment if the client machine hostname doesn't match the computer object on the DC.
# ad_hostname = mymachine.myubuntu.example.com

# Uncomment if DNS SRV resolution is not working
# ad_server = dc.mydomain.example.com

# Uncomment if the AD domain is named differently than the Samba domain
# ad_domain = MYUBUNTU.EXAMPLE.COM

# Enumeration is discouraged for performance reasons.
enumerate = true

/etc/nsswitch.conf

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat sss
group:          compat sss
shadow:         compat

hosts:          files mdns4_minimal [NOTFOUND=return] dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis sss
sudoers:        files sss
Improve this question

2 Answers 2

Reset to default
1

The order of authentication sources takes place before sssd is consulted, by nss.

In /etc/nsswitch.conf will be something like:

passwd      files sss
shadow      files sss

Reversing sss and files will cause your system to query AD for user information before local files. Whether this is a good idea is another question.

Do you really need a local account that shares the name of the AD account that you wish to make use of?

Improve this answer
1
  • Thanks Andy. so files sss means it ill look in the local passwd file first then look at sss and swapping them reverses the process. I don't need the local a/c to match but I was just curious how it could be overcome. I note that at no point can I login using an AD unique a/c with the domain suffix. I can only use the username...
    – Dercni
    Dec 17, 2015 at 10:35
0

You should set use_fully_qualified_names to True in your [domain/AD.HERE.COM.AU] section. It means that the local accounts can be distinguished from the Active Directory accounts as it requires AD users login using user@domain instead of just user.

Improve this answer
5
  • with this option specified I am no longer able to login using the AD accounts. i.e. neither of the following works: administrator or [email protected]. Without this option I can login as administration as it is unique to ad.
    – Dercni
    Dec 17, 2015 at 10:17
  • @user1567212 Sorry. I can't help you any more. Using SSS "just worked" for me (more reliably than Winbind) so I never needed to research it in-depth.
    – Anthony Geoghegan
    Dec 17, 2015 at 10:28
  • @user1567212 Actually, how are you logging in to the Ubuntu host? Graphically or via SSH? If it's SSH can you include your command line (e.g., ssh user@ad_domain@ubuntu_hostname) and the output when it fails.
    – Anthony Geoghegan
    Dec 17, 2015 at 10:34
  • I am logging in use the gui.
    – Dercni
    Dec 17, 2015 at 10:49
  • @user1567212 My last suggestion would be to check the relevant log file(s). I don't use Ubuntu server but /var/log/syslog would be the most likely candidate.
    – Anthony Geoghegan
    Dec 17, 2015 at 11:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .