1

I've just installed Ubuntu 20.10 and I enabled Active Directory integration during setup. It asked me AD user and password, I provided those and the setup showed green thicks and went on.

After completing setup, I tried to login with a domain user (ufficio.lan\lucio), but it failed as if the password was incorrect (which was not, I tried several times and I'm sure about my password). I then logged in with the local user I created during setup and checked the machine was effectively joined to the domain:

# realm join -U Administrator ufficio.lan
realm: already joined to this domain

Please note that after trying to login with my AD user, gdm added my real name and surname to the list of available users, so it actually managed to contact my AD server and obtain some information about me. However it didn't create the home directory, nor it mounted my home directory that the server shares (this would be my final goal) and it didn't let me in, as described above.

I tried to install Ubuntu 20.10 from scratch again, just in case I made some mistakes the first time, but I got the same results.

The server is a Zentyal Community Edition 6.2 and other Linux computers in the LAN manage to login with AD credentials, but those are old Fedora or Ubuntu 14.04 setups that were manually joined to the AD domain back then, so I can't just copy /etc/ over and hope for the best: it won't work.

EDIT after Sturban's answer:

Before reinstalling from scratch I had already tried to follow the guide linked in the answer, but it did not solve the problem. It was precisely that guide that, in Step 5, suggested me the command

# realm join -U Administrator ufficio.lan

to check if the system was already joined to the domain. Despite being already joined, I tried following that guide anyway (even from its Step 1), but at the end of Step 5 the id command did not find my domain user and gdm kept refusing my domain login and not creating my home directory.

Anyway, I suspect the point is quite different, and that's why I did not mention these trials before: Ubuntu 20.10 has AD integration option during setup and it's a new feature that up to 20.04 included did not exist, so I suspect something different is needed on Ubuntu 20.10, while that guide assumes Ubuntu 20.04.

EDIT #2

I've tried starting from fresh Zentyal 6.2 + Ubuntu 20.04 (mind it, not 20.10) virtual machines in a virtual LAN and then following the guide linked in Sturban's answer, which is supposed to be valid for Ubuntu 20.04. It didn't work just the same way as with Ubuntu 20.10.

To be honest, I did NOT follow the guide verbatim (never did that), but I always assumed I had to adapt Step 1 to the actual OS I was using. Step 1 suggests to add Ubuntu 18.04 repositories to /etc/apt/sources.list, but I always assumed it actually means I have to add my distro repositories that contain the packages to be installed in Step 3. Besides, I think adding bionic repos to a focal or buster setup and then installing old packages from there would wreck the OS of its own, right? Or do I really have to go through the hassle of adding outdated repos to a current OS in order to have AD authentication working?

Other than that, I followed the guide verbatim, but at the end of step 5 the id command still could not find AD users.

So now I assume my question is applicable to Ubuntu 20.04 too, and that guide is more outdated than I thought. That means if you know the solution to have AD users authentication working on Ubuntu 20.04 I assume it will work on Ubuntu 20.10 too, but that guide is missing something and it's not enough as solution.

1
  • You should login with domain username only (lucio) or SPN (lucio@ufficio.lan). Sep 6, 2021 at 10:41

2 Answers 2

0

Excerpt from a great tutorial on joining Linux-machines to an AD.

On RHEL based systems, user’s home directory will be created automatically. On Ubuntu / Debian, you need to enable this feature.

sudo bash -c "cat > /usr/share/pam-configs/mkhomedir" <<EOF
Name: activate mkhomedir
Default: yes
Priority: 900
Session-Type: Additional
Session:
        required                        pam_mkhomedir.so umask=0022 skel=/etc/skel
EOF
3
  • I omitted to add this in my question (going to edit it now), but I had already tried that before deciding to reinstall everything from scratch becasue it didn't solve the problem. Nov 26, 2020 at 9:17
  • I'm also experiencing this issue.
    – SteveSims
    May 21, 2021 at 18:44
  • or I was.....the only thing I did was run pam-auth-update again. Didn't change anything, just chose OK, and hit return. Suddenly everything was working again. Domain users could login.
    – SteveSims
    May 21, 2021 at 18:52
0

A solution posted elsewhere on this forum for the given problem is to set

ad_gpo_access_control = permissive 

in the [domain] section of file /etc/sssd/sssd.conf

Source: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=859445

Worked for me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.