I'm having an issue for authenticating via LDAP from a CentOS 7 machine to a Windows Server 2012 R2 DC via SSSD.

Linux WS100 3.10.0-957.10.1.el7.x86_64 #1 SMP Mon Mar 18 15:06:45 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

ldapsearch can successfully query the directory, via plain LDAP, with no problems

ldapsearch -x -h dc.company.local -D "cn=some user,cn=users,dc=company,dc=local" -w thePassword -b "cn=users,dc=company,dc=local" -s sub "(cn=*)" cn mail sn

And these are the steps done to configure SSSD to this purpose

yum install sssd sssd-client
authconfig --enablesssd --enablesssdauth --ldapserver=dc.company.local --ldapbasedn="cn=users,dc=company,dc=local" --update

/etc/nsswitch.conf contains the entries for sss

passwd: files sss
shadow: files sss
group: files sss

And /etc/sssd/sssd.conf is configured this way:

domains = company.local
config_file_version = 2
services = nss, pam

id_provider = ldap
auth_provider = ldap
ldap_schema = ad
ldap_uri = ldap://dc.company.local
ldap_search_base = cn=users,dc=company,dc=local
ldap_default_bind_dn = cn=some user,cn=users,dc=company,dc=local
ldap_default_authtok_type = password
ldap_default_authtok = thePassword
override_homedir = /home/%u

But su - username nor su - username@company.local does not work. There are network transactions to the domain controller as inspected by tcpdump, but I suppose the credentials are not correctly formatted for the schema I use (ad).

I tried emptying SSSD cache and restarting the daemon, with no difference. I find no related messages in /var/log/secure, and /var/log/sssd/ logs do not point to a misconfiguration.

Can anybody give me a hand? Have you faced a similar issue or may propose another solution doable in a similar setup?

Thank you!


You should probably be using id_provider = ad rather than ldap which is what I use in my SSSD configuration against AD. auth_provider defaults to the same value as id_provider so you can omit that and using the ad backend implies ldap_schema = ad too.

  • I tried, leaving only id_provider = ad, and then the service cannot be started (Failed to read keytab [default]: No such file or directory). I'd like to clarify that I do not want to bind the machine to AD, only enable LDAP-based logins. – tallaferrox May 2 at 11:05
  • Yes, sssd-ad(5) mentions that the machine is required to be joined to AD, (it would then have a keytab file). I would update your question to clarify the situation. – bodgit May 2 at 12:29
  • Many thanks bodgit, just comment that I'd like not to bind the machine to AD... – tallaferrox May 2 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.