Samba – sssd active directory username same as local user

active-directorysambasssd

Hi have a Ubuntu box setup to login to AD.

I can login to AD using usernames that do not match local usernames however I have a local username that also exists in AD and I want to be able to login to AD as that user.

I have tried user@domain and DOMAIN\user but neither works. If I login using "user" without any domain then it logs in locally.

/etc/sssd/sssd.conf

[sssd]
services = nss, pam
config_file_version = 2
domains = AD.HERE.COM.AU

[domain/AD.HERE.COM.AU]
id_provider = ad
access_provider = ad

# Use this if users are being logged in at /.
# This example specifies /home/DOMAIN-FQDN/user as $HOME.  Use with pam_mkhomedir.so
override_homedir = /home/%d/%u

# Uncomment if the client machine hostname doesn't match the computer object on the DC.
# ad_hostname = mymachine.myubuntu.example.com

# Uncomment if DNS SRV resolution is not working
# ad_server = dc.mydomain.example.com

# Uncomment if the AD domain is named differently than the Samba domain
# ad_domain = MYUBUNTU.EXAMPLE.COM

# Enumeration is discouraged for performance reasons.
enumerate = true

/etc/nsswitch.conf

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat sss
group:          compat sss
shadow:         compat

hosts:          files mdns4_minimal [NOTFOUND=return] dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis sss
sudoers:        files sss

Best Answer

The order of authentication sources takes place before sssd is consulted, by nss.

In /etc/nsswitch.conf will be something like:

passwd      files sss
shadow      files sss

Reversing sss and files will cause your system to query AD for user information before local files. Whether this is a good idea is another question.

Do you really need a local account that shares the name of the AD account that you wish to make use of?