Hi have a Ubuntu box setup to login to AD.
I can login to AD using usernames that do not match local usernames however I have a local username that also exists in AD and I want to be able to login to AD as that user.
I have tried user@domain and DOMAIN\user but neither works. If I login using "user" without any domain then it logs in locally.
/etc/sssd/sssd.conf
[sssd]
services = nss, pam
config_file_version = 2
domains = AD.HERE.COM.AU
[domain/AD.HERE.COM.AU]
id_provider = ad
access_provider = ad
# Use this if users are being logged in at /.
# This example specifies /home/DOMAIN-FQDN/user as $HOME. Use with pam_mkhomedir.so
override_homedir = /home/%d/%u
# Uncomment if the client machine hostname doesn't match the computer object on the DC.
# ad_hostname = mymachine.myubuntu.example.com
# Uncomment if DNS SRV resolution is not working
# ad_server = dc.mydomain.example.com
# Uncomment if the AD domain is named differently than the Samba domain
# ad_domain = MYUBUNTU.EXAMPLE.COM
# Enumeration is discouraged for performance reasons.
enumerate = true
/etc/nsswitch.conf
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.
passwd: compat sss
group: compat sss
shadow: compat
hosts: files mdns4_minimal [NOTFOUND=return] dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis sss
sudoers: files sss
Best Answer
The order of authentication sources takes place before sssd is consulted, by nss.
In /etc/nsswitch.conf will be something like:
Reversing sss and files will cause your system to query AD for user information before local files. Whether this is a good idea is another question.
Do you really need a local account that shares the name of the AD account that you wish to make use of?