I'm trying out sssd to use krb5 for authentication on a Ubuntu 18.04 host and can't figure out how to show the actual user groups (groups shows some sort of Windows SID instead of human readable names). The primary group looks ok (Domain Users…) but the rest (supplementary) are all S-x-x-x numbers. Is this an AD setting or something with my sssd config?
$ groups
Domain Users@ad.mycorp.com S-1-5-21-944445629-1489980678-184074267-871221@ad.mycorp.com S-1-5-21-944445629-1489980678-184074267-871222@ad.mycorp.com...
sssd.conf
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
[pam]
reconnection_retries = 3
[sssd]
domains = ad.mycorp.com
config_file_version = 2
services = nss, pam
reconnection_retries = 3
sbus_timeout = 30
[domain/ad.mycorp.com]
ad_domain = ad.mycorp.com
krb5_realm = ad.mycorp.com
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
default_shell = /bin/bash
fallback_homedir = /home/%d/%u
krb5_store_password_if_offline = True
use_fully_qualified_names = True
ldap_sasl_authid = UBU-TEST1$
ldap_id_mapping = True
access_provider = ldap
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
ldap_uri = ldaps://ad.mycorp.com
ldap_search_base = ou=mycorp,dc=mycorp,dc=com
ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
ldap_tls_reqcert = allow
dns_discovery_domain = ad.mycorp.com
ldap_user_search_base = ou=userid,ou=mycorp,dc=mycorp,dc=com
ldap_group_search_base = ou=mycorp,dc=mycorp,dc=com
ldap_user_object_class = user
ldap_user_name = sAMAccountName
ldap_user_fullname = displayName
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_group_object_class = group
ldap_group_name = sAMAccountName
ldap_schema = rfc2307bis
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
Best Answer
This is a bit old but I thought that I would share the solution that worked for me.
I solved this by adding a line to the sssd.conf file, in the [domain/example.local] section :
and keep