I'm using Centos 7 to authenticate locally Active directory users using kerberos. I joined the realm with the Administrator and i can login/ssh through it/with it, nslookup working fine, and adcli info is working. When i create another user called test and try to login through Centos i get the following :
id: test: no such user
getent passwd test doesn't return anything
Here are my configuration files:
sssd.conf
domains = gio.server
config_file_version = 2
services = nss, pam
[domain/gio.server]
ad_domain = gio.server
krb5_realm = GIO.SERVER
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%u
access_provider = ad
Here is the krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default = GIO.SERVER
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
# default_realm = EXAMPLE.COM
default_ccache_name = KEYRING:persistent:%{uid}
default_realm = GIO.SERVER
[realms]
GIO.SERVER = {
kdc = gio.server:88
default_domain = gio.server
# kdc = kerberos.example.com
# admin_server = kerberos.example.com
}
[domain_realm]
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM
.gio.server = GIO.SERVER
gio.server = GIO.SERVER
However when i was troubleshooting using sssctl user-checks test it returned the following error:
user: test
action: acct
service: system-auth
sss_getpwnam_r failed with [0].
User name lookup with [test] failed.
Unable to get user objectInfoPipe User lookup with [test] failed.
testing pam_acct_mgmt
pam_acct_mgmt: User not known to the underlying authentication module
PAM Environment:
- no env -
Please if something is missing let me know.