但是,当我使用启用了IMU的Windows Server 2012 R2服务器时,我能够获取kerberos票证,加入域,搜索LDAP,但是当我尝试从控制台以AD用户身份登录时,我在/ var / log / messages中收到此错误消息：

Jun 6 11:12:30 test [sssd[krb5_child[4760]]]: Preauthentication Failed

/ var / log / secure显示以下错误消息：

Jun 6 11:12:15 test login: pam_sss(login:auth): received for user aduser@domain.local: 17 (Failure setting user credentials)

Jun 6 11:12:17 test login: Failed LOGIN 1 FROM (null) FOR aduser@domain.local,Authentication failure

使用getent passwd aduser或getent group linuxgroup成功返回.

我试过这个sssd.conf文件：

[sssd]
config_file_version = 2
services = nss,pam
domains = domain.local
debug_level = 5
 
[domain/domain.local]
id_provider = ad
auth_provider = ad
 
ad_server = dc.domain.local
 
default_shell = /bin/bash
fallback_homedir = /home/%d/%u
 
cache_credentials = false
ldap_id_mapping = false

然后我读了this错误报告.所以,我将我的sssd.conf文件更改为：

[sssd]
config_file_version = 2
reconnection_retries = 2
services = nss,pam
debug_level = 5
domains = domain.local
 
[nss]
debug_level = 5
 
[pam]
debug_level = 5
 
[domain/domain.local]
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
debug_level = 5
 
ldap_uri = ldap://dc.domain.local/
ldap_sasl_mech = GSSAPI
ldap_schema = rfc2307bis
 
ldap_user_search_base = dc=domain,dc=local
ldap_user_object_class = user
 
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
 
ldap_group_search_base = dc=domain,dc=local
ldap_group_object_class = group
 
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
 
ldap_referrals = false
 
krb5_server = dc.domain.local
krb5_realm = DOMAIN.LOCAL
krb5_canonicalize = false
 
enumerate = false
cache_credentials = false

我已经清除了我的SSSD缓存并重新启动了该服务.但我无法登录.

我现在在/ var / log / messages中收到此错误：

Jun 6 11:21:43 test [sssd[krb5_child[1546]]]: Permission denied

我在/var/log/sssd/krb5_child.log中看到了这个错误：

(Sat Jun 6 11:21:43 2015) [[sssd[krb5_child[1387]]]] [sss_get_ccache_name_for_principal] (0x2000): krb5_cc_cache_match Failed: [-1765328243][Can’t find client principal aduser@DOMAIN.LOCAL in cache collection]

(Sat Jun 6 11:21:43 2015) [[sssd[krb5_child[1387]]]] [create_ccache] (0x0020): 575: [13][Permission denied]

现在,这就是它变得奇怪的地方.作为root用户,如果我对任何AD域用户说它实际上是有效的,并且主目录是自动创建的.我即将承认失败并坚持使用2k8 DC.