我正在嘗試將我的CentOS 6.6服務器集成到Active Directory中.我使用配置3(SSSD / Kerberos / LDAP)遵循Red Hat的

this指南.使用Windows Server 2008 R2服務器作為啟用IMU的域控制器時,一切都運行良好.

但是,當我使用啟用了IMU的Windows Server 2012 R2服務器時,我能夠獲取kerberos票證,加入域,搜索LDAP,但是當我嘗試從控制臺以AD用戶身份登錄時,我在/ var / log / messages中收到此錯誤消息：

Jun 6 11:12:30 test [sssd[krb5_child[4760]]]: Preauthentication failed

/ var / log / secure顯示以下錯誤消息：

Jun 6 11:12:15 test login: pam_sss(login:auth): received for user aduser@domain.local: 17 (Failure setting user credentials)

Jun 6 11:12:17 test login: FAILED LOGIN 1 FROM (null) FOR aduser@domain.local, Authentication failure

使用getent passwd aduser或getent group linuxgroup成功返回.

我試過這個sssd.conf文件：

[sssd]

config_file_version = 2

services = nss, pam

domains = domain.local

debug_level = 5

[domain/domain.local]

id_provider = ad

auth_provider = ad

ad_server = dc.domain.local

default_shell = /bin/bash

fallback_homedir = /home/%d/%u

cache_credentials = false

ldap_id_mapping = false

然后我讀了this錯誤報告.所以,我將我的sssd.conf文件更改為：

[sssd]

config_file_version = 2

reconnection_retries = 2

services = nss,pam

debug_level = 5

domains = domain.local

[nss]

debug_level = 5

[pam]

debug_level = 5

[domain/domain.local]

id_provider = ldap

auth_provider = krb5

chpass_provider = krb5

debug_level = 5

ldap_uri = ldap://dc.domain.local/

ldap_sasl_mech = GSSAPI

ldap_schema = rfc2307bis

ldap_user_search_base = dc=domain,dc=local

ldap_user_object_class = user

ldap_user_home_directory = unixHomeDirectory

ldap_user_principal = userPrincipalName

ldap_group_search_base = dc=domain,dc=local

ldap_group_object_class = group

ldap_access_order = expire

ldap_account_expire_policy = ad

ldap_force_upper_case_realm = true

ldap_referrals = false

krb5_server = dc.domain.local

krb5_realm = DOMAIN.LOCAL

krb5_canonicalize = false

enumerate = false

cache_credentials = false

我已經清除了我的SSSD緩存并重新啟動了該服務.但我無法登錄.

我現在在/ var / log / messages中收到此錯誤：

Jun 6 11:21:43 test [sssd[krb5_child[1546]]]: Permission denied

我在/var/log/sssd/krb5_child.log中看到了這個錯誤：

(Sat Jun 6 11:21:43 2015) [[sssd[krb5_child[1387]]]] [sss_get_ccache_name_for_principal] (0x2000): krb5_cc_cache_match failed: [-1765328243][Can’t find client principal aduser@DOMAIN.LOCAL in cache collection]

(Sat Jun 6 11:21:43 2015) [[sssd[krb5_child[1387]]]] [create_ccache] (0x0020): 575: [13][Permission denied]

現在,這就是它變得奇怪的地方.作為root用戶,如果我對任何AD域用戶說它實際上是有效的,并且主目錄是自動創建的.我即將承認失敗并堅持使用2k8 DC.

創作挑戰賽新人創作獎勵來咯，堅持創作打卡瓜分現金大獎

總結

以上是生活随笔為你收集整理的windows dc linux,active-directory – Linux AD集成,使用Windows Server 2012 DC时无法登录的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。