1

I have converted my Ubuntu 14.04.1 systems over to kerberos authentication using corporate AD servers. The instructions said to install sssd, libpam-sss, libnss-sss. These package installations would change the pam setup to enable krb5 authentication.

I copied over my fully functioning sssd.conf files from my centos environment. My sssd.conf file sets up my ldap connection config, my krb5 realms. I also copied over my fully functional /etc/krb5.conf. After I added the packages, the nsswitch.conf file looked like:

passwd  compat ldap sss
group   compat ldap sss
shadow  compat ldap

My question is, since I'm using sssd I would have thought that nslcd functionality was no longer needed. But if I shut that service down I am unable to login. When I login, I do get a kerberos ticket. I just find it odd that I need nslcd. Can anyone explain how this is supposed to work?

Does the nsswitch.conf file look correct? I would have thought ldap would no longer be needed as the sssd handles all of that. At least that's how its handled on centos.

I'd welcome anyone to clear the air for me.

1 Answer 1

1

Did you try

passwd  compat sss
group   compat sss
shadow  compat 
? for nsswitch.conf

ldap is for nslcd

Then sssd is preferably for Fedora and nslcd for Ubuntu

1
  • I apologize for the long delay. sssd needs providers to provide authentication, id etc.. Since this isn't a pure AD setup, as in no keytab file etc.. this Kerberos setup uses LDAP to find the uid/gid username and the rest of the users information. So LDAP part is needed, and the Kerberos part is simply to satisfy the actual password portion. And this works, so I think I answered my own question. Both SSSD and nslcd is needed. Another issue is now users cannot change their passwords, and when notified that their password has expired, the user has to login to a windows system to change it. ugh
    – rocker65
    Oct 22, 2014 at 17:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .