We use sssd for user management with the account information from a Samba AD Domain Controller.
The sssd-configuration on linux clients looks as follows:
[sssd]
services = nss, pam,ssh
config_file_version = 2
domains = EXAMPLE.DOMAIN.EU
[ssh]
debug_level = 3
[nss]
debug_level = 3
filter_users = root
filter_groups = root
default_shell = /bin/bash
[pam]
debug_level = 3
[domain/EXAMPLE.DOMAIN.EU]
debug_level = 3
id_provider = ad
access_provider = ad
override_homedir = /home/%u
ad_server = adserver
enumerate = true
cache_credentials = true
create_homedir = true
ldap_user_ssh_public_key = sshPublicKey
ad_gpo_access_control = disabled
For this to work, the client systems need need to join the domain. During the join process, they receive their kerberos ticket. The kerberos configuration looks the following:
[libdefaults]
default = DOMAIN.EU
default_realm = EXAMPLE.DOMAIN.EU
dns_lookup_realm = true
dns_lookup_kdc = true
fcc-mit-ticketflags = true
[realms]
EXAMPLE.DOMAIN.EU = {
kdc = adserver
admin_server = adserver
default_domain = domain.eu
}
DOMAIN.EU = {
kdc = adserver
admin_server = adserver
}
[domain_realm]
.domain.eu = EXAMPLE.DOMAIN.EU
domain.eu = EXAMPLE.DOMAIN.EU
Using the same config files on the Samba AD Domain Controller results in a failure during startup of sssd, because kerberos can not find a the machine ticket:
[find_principal_in_keytab] (0x0020): krb5_kt_start_seq_get failed.
joining the server to the domain would probably be wrong.
How does the correct configuration for sssd look on the Samba AD Domain Controller?