我正在尝试将我的CentOS 6.6服务器集成到Active Directory中.我使用配置3(SSSD / Kerberos / LDAP)遵循Red Hat的
this指南.使用Windows Server 2008 R2服务器作为启用IMU的域控制器时,一切都运行良好.
但是,当我使用启用了IMU的Windows Server 2012 R2服务器时,我能够获取kerberos票证,加入域,搜索LDAP,但是当我尝试从控制台以AD用户身份登录时,我在/ var / log / messages中收到此错误消息:
Jun 6 11:12:30 test [sssd[krb5_child[4760]]]: Preauthentication failed
/ var / log / secure显示以下错误消息:
Jun 6 11:12:15 test login: pam_sss(login:auth): received for user aduser@domain.local: 17 (Failure setting user credentials)
Jun 6 11:12:17 test login: FAILED LOGIN 1 FROM (null) FOR aduser@domain.local, Authentication failure
使用getent passwd aduser或getent group linuxgroup成功返回.
我试过这个sssd.conf文件:
[sssd]
config_file_version = 2
services = nss, pam
domains = domain.local
debug_level = 5
[domain/domain.local]
id_provider = ad
auth_provider = ad
ad_server = dc.domain.local
default_shell = /bin/bash
fallback_homedir = /home/%d/%u
cache_credentials = false
ldap_id_mapping = false
然后我读了this错误报告.所以,我将我的sssd.conf文件更改为:
[sssd]
config_file_version = 2
reconnection_retries = 2
services = nss,pam
debug_level = 5
domains = domain.local
[nss]
debug_level = 5
[pam]
debug_level = 5
[domain/domain.local]
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
debug_level = 5
ldap_uri = ldap://dc.domain.local/
ldap_sasl_mech = GSSAPI
ldap_schema = rfc2307bis
ldap_user_search_base = dc=domain,dc=local
ldap_user_object_class = user
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_group_search_base = dc=domain,dc=local
ldap_group_object_class = group
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
ldap_referrals = false
krb5_server = dc.domain.local
krb5_realm = DOMAIN.LOCAL
krb5_canonicalize = false
enumerate = false
cache_credentials = false
我已经清除了我的SSSD缓存并重新启动了该服务.但我无法登录.
我现在在/ var / log / messages中收到此错误:
Jun 6 11:21:43 test [sssd[krb5_child[1546]]]: Permission denied
我在/var/log/sssd/krb5_child.log中看到了这个错误:
(Sat Jun 6 11:21:43 2015) [[sssd[krb5_child[1387]]]] [sss_get_ccache_name_for_principal] (0x2000): krb5_cc_cache_match failed: [-1765328243][Can’t find client principal aduser@DOMAIN.LOCAL in cache collection]
(Sat Jun 6 11:21:43 2015) [[sssd[krb5_child[1387]]]] [create_ccache] (0x0020): 575: [13][Permission denied]
现在,这就是它变得奇怪的地方.作为root用户,如果我对任何AD域用户说它实际上是有效的,并且主目录是自动创建的.我即将承认失败并坚持使用2k8 DC.