我正在尝试将我的CentOS 6.6服务器集成到Active Directory中.我使用配置3(SSSD / Kerberos / LDAP)遵循Red Hat的

this指南.使用Windows Server 2008 R2服务器作为启用IMU的域控制器时,一切都运行良好.

但是,当我使用启用了IMU的Windows Server 2012 R2服务器时,我能够获取kerberos票证,加入域,搜索LDAP,但是当我尝试从控制台以AD用户身份登录时,我在/ var / log / messages中收到此错误消息：

Jun 6 11:12:30 test [sssd[krb5_child[4760]]]: Preauthentication failed

/ var / log / secure显示以下错误消息：

Jun 6 11:12:15 test login: pam_sss(login:auth): received for user aduser@domain.local: 17 (Failure setting user credentials)

Jun 6 11:12:17 test login: FAILED LOGIN 1 FROM (null) FOR aduser@domain.local, Authentication failure

使用getent passwd aduser或getent group linuxgroup成功返回.

我试过这个sssd.conf文件：

[sssd]

config_file_version = 2

services = nss, pam

domains = domain.local

debug_level = 5

[domain/domain.local]

id_provider = ad

auth_provider = ad

ad_server = dc.domain.local

default_shell = /bin/bash

fallback_homedir = /home/%d/%u

cache_credentials = false

ldap_id_mapping = false

然后我读了this错误报告.所以,我将我的sssd.conf文件更改为：

[sssd]

config_file_version = 2

reconnection_retries = 2

services = nss,pam

debug_level = 5

domains = domain.local

[nss]

debug_level = 5

[pam]

debug_level = 5

[domain/domain.local]

id_provider = ldap

auth_provider = krb5

chpass_provider = krb5

debug_level = 5

ldap_uri = ldap://dc.domain.local/

ldap_sasl_mech = GSSAPI

ldap_schema = rfc2307bis

ldap_user_search_base = dc=domain,dc=local

ldap_user_object_class = user

ldap_user_home_directory = unixHomeDirectory

ldap_user_principal = userPrincipalName

ldap_group_search_base = dc=domain,dc=local

ldap_group_object_class = group

ldap_access_order = expire

ldap_account_expire_policy = ad

ldap_force_upper_case_realm = true

ldap_referrals = false

krb5_server = dc.domain.local

krb5_realm = DOMAIN.LOCAL

krb5_canonicalize = false

enumerate = false

cache_credentials = false

我已经清除了我的SSSD缓存并重新启动了该服务.但我无法登录.

我现在在/ var / log / messages中收到此错误：

Jun 6 11:21:43 test [sssd[krb5_child[1546]]]: Permission denied

我在/var/log/sssd/krb5_child.log中看到了这个错误：

(Sat Jun 6 11:21:43 2015) [[sssd[krb5_child[1387]]]] [sss_get_ccache_name_for_principal] (0x2000): krb5_cc_cache_match failed: [-1765328243][Can’t find client principal aduser@DOMAIN.LOCAL in cache collection]

(Sat Jun 6 11:21:43 2015) [[sssd[krb5_child[1387]]]] [create_ccache] (0x0020): 575: [13][Permission denied]

现在,这就是它变得奇怪的地方.作为root用户,如果我对任何AD域用户说它实际上是有效的,并且主目录是自动创建的.我即将承认失败并坚持使用2k8 DC.