I am using SSSD to authenticate users on Linux against a local Active Directory server (Windows). It works fine, this is my config:
[sssd] domains = my.domain config_file_version = 2 services = nss, pam [domain/my.domain] ad_domain = my.domain ad_server = my-dc.my.domain krb5_realm = MY.DOMAIN realmd_tags = joined-with-samba cache_credentials = true auth_provider = ad id_provider = ad krb5_store_password_if_offline = true default_shell = /bin/bash ldap_id_mapping = true use_fully_qualified_names = false fallback_homedir = /home/%u access_provider = simple simple_allow_groups = IT
The problem is: we have one user who wants
zsh. So I changed the users loginShell attribute to
/usr/bin/zsh. This works fine the first time the user logs in. But as soon as the user has logged in and I do
getent passwd username, it says the user's shell is
/bin/bash. So when the user logs out and in again, indeed
bash is used as shell.
When I do
sss_cache -u username, the shell is set correctly again and the user gets the correct shell on login. I do not want to disable caching because any domain controller downtime should not have an impact on the Linux user logins.
I tried to remove
default_shell, but it only changes that the default shell is empty instead of
/bin/bash, so same behaviour.