Active directory issue with CentOS 7

quqonlik · 06-24-2019, 02:34 PM

Can someone suggest anything? I cloned the server from existing one which we use LDAP and AD authentication but cloned server is not syncing with AD anymore. I tried to rejoin it but after rejoining my exsiting username no longer exist. Also I see the following:

SSSD status active but:
sssd[be[adserver.com]][15170]: Backend is offline

sssd_pam log:

[sssd[pam]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]

SSSD conf file:

[sssd]
domains = adserver.com
config_file_version = 2
services = nss, pam

[domain/adserver.com]
ad_domain = adserver.com.com
krb5_realm = ADSERVER.COM
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_sasl_authid = test-b8-devsub$
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%u
access_provider = ad
[pam]

Any suggestion or resolution appreciated!

Thank you,

dc.901 · 06-25-2019, 06:20 AM

Quote:

Originally Posted by quqonlik

Can someone suggest anything? I cloned the server from existing one which we use LDAP and AD authentication but cloned server is not syncing with AD anymore.

So, after cloning the machine, did you rename the clone? Or, do you have now two machines with same name?
If the clone was renamed, does the AD Object exists? If you do not know ask your AD admin.

Quote:

Originally Posted by quqonlik

I tried to rejoin it but after rejoining my exsiting username no longer exist.

How exactly did you do that? Can you show which commands you ran?

What is the OS? Did you check syslog, and event logs on your AD server?

onebuck · 06-25-2019, 08:34 AM

Moved: This thread is more suitable in <CentOS> and has been moved accordingly to help your thread/question get the exposure it deserves.

quqonlik · 06-25-2019, 09:48 AM

Quote:

Originally Posted by dc.901

So, after cloning the machine, did you rename the clone? Or, do you have now two machines with same name?
If the clone was renamed, does the AD Object exists? If you do not know ask your AD admin.

Quote:

Originally Posted by dc.901

Yes, I renamed hostname and all config parameters. The clone was done through vmware. I checked Active Directory server and I do see joined host "test-b8-devsub"

How exactly did you do that? Can you show which commands you ran?

realm join -v --computer-name=ADSERVER.COM --user=me_admin adserver.com

Output:

Using short domain name -- ADSERVER.COM
Joined 'test-b8-devsub' to dns domain 'adserver.com'
No DNS domain configured for ddil-t8-devsub. Unable to perform DNS Update.
* LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf -U me_admin ads keytab create
Enter me_admin's password:
* /usr/bin/systemctl enable sssd.service
Created symlink from /etc/systemd/system/multi-user.target.wants/sssd.service to /usr/lib/systemd/system/sssd.service.
* /usr/bin/systemctl restart sssd.service
* /usr/bin/sh -c /usr/sbin/authconfig --update --enablesssd --enablesssdauth --enablemkhomedir --nostart && /usr/bin/systemctl enable oddjobd.service && /usr/bin/systemctl start oddjobd.service
* Successfully enrolled machine in realm

What is the OS? Did you check syslog, and event logs on your AD server?

Cloned server is CentOS 7. I haven't check the logs from AD side yet. I tried to rejoining the host it joins fines but tells no userexists when I tried to switch to my ad admin existing user.

quqonlik · 06-25-2019, 10:09 AM

I found the root cause. Selinux and firewalld were causing the connecting between AD and Linux host. Turning them off fixed the issue.