# ActiveDirectory integration problem in Rocky9 **URL:** \ **Category:** Rocky Linux Help & Support\ **Created:** [November 19, 2022, 1:36pm UTC](https://forums.rockylinux.org/t/activedirectory-integration-problem-in-rocky9/7927 "2022-11-19T13:36:11Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![dragz](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@dragz](https://forums.rockylinux.org/u/dragz)\ **Post date:** [November 19, 2022, 1:36pm UTC](https://forums.rockylinux.org/t/activedirectory-integration-problem-in-rocky9/7927/1 "2022-11-19T13:36:11Z")
Hi, I’ve started looking into migrating a jupyterhub service from Rocky 8 to Rocky 9 and found that the AD integration fails. I’m using the exact same config as in Rocky 8 (ansible playbook) and the realm join is successful, but user lookups fail on Rocky 9. Joining with realm join -U abc123-admin OUR.DOMAIN.DUMMY It seems to be successful realm list OUR.DOMAIN.DUMMY our.domain.dummy type: kerberos realm-name: OUR.DOMAIN.DUMMY domain-name: our.domain.dummy configured: kerberos-member server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common-tools login-formats: %U@our.domain.dummy login-policy: allow-realm-logins Testing with getent passwd abc123@our.domain.dummy does not yield any result and /var/log/sssd/ldap\_child.log contains a lot of these (2022-11-19 14:12:27): [ldap\_child[3440]] [main] (0x0020): ldap\_child\_get\_tgt\_sync failed. \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: - (2022-11-19 14:12:27): [ldap\_child[3440]] [ldap\_child\_get\_tgt\_sync] (0x0010): Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: KDC has no support for encryption type. Unable to create GSSAPI-encrypted LDAP connection. Everything works ok on my prod cluster running Rocky 8.7. On my prod system /var/log/sssd/ldap\_child.log is empty. Troubleshooting so far: realm leave update-crypto-policies --set LEGACY reboot realm join → no change in behavior. Any thoughts? Am I missing something obvious? Best regards Roy (The jupyter service is running on a small cluster in Azure with AzureAD login and AD for uid-lookups and user verification) ---
**Author:** ![gerry666uk](https://avatars.discourse-cdn.com/v4/letter/g/dbc845/32.png) [@gerry666uk](https://forums.rockylinux.org/u/gerry666uk)\ **Post date:** [November 19, 2022, 3:47pm UTC](https://forums.rockylinux.org/t/activedirectory-integration-problem-in-rocky9/7927/2 "2022-11-19T15:47:06Z")
> [@dragz](#): > > KDC has no support for encryption type. It would help to know what “encryption type” it’s trying to use, e.g. on the old, and then on the new? ---
**Author:** ![dragz](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@dragz](https://forums.rockylinux.org/u/dragz)\ **Post date:** [November 19, 2022, 4:03pm UTC](https://forums.rockylinux.org/t/activedirectory-integration-problem-in-rocky9/7927/3 "2022-11-19T16:03:58Z")
Yes, any ideas on how to get that? Increase loglevel, grepping logfiles? ---
**Author:** ![dali](https://avatars.discourse-cdn.com/v4/letter/d/c68b51/32.png) [@dali](https://forums.rockylinux.org/u/dali)\ **Post date:** [November 20, 2022, 12:48pm UTC](https://forums.rockylinux.org/t/activedirectory-integration-problem-in-rocky9/7927/4 "2022-11-20T12:48:46Z")
This should list encryption(s) used for kerberos principals in the system keytab: ```auto sudo klist -kte ``` ---
**Author:** ![wagegede](https://avatars.discourse-cdn.com/v4/letter/w/4af34b/32.png) [@wagegede](https://forums.rockylinux.org/u/wagegede)\ **Post date:** [November 23, 2022, 8:06am UTC](https://forums.rockylinux.org/t/activedirectory-integration-problem-in-rocky9/7927/5 "2022-11-23T08:06:54Z")
Hello. This is, what I did to get it working: /usr/bin/update-crypto-policies --set DEFAULT:AD-SUPPORT ---
**Author:** ![linde](https://avatars.discourse-cdn.com/v4/letter/l/e36b37/32.png) [@linde](https://forums.rockylinux.org/u/linde)\ **Post date:** [November 24, 2022, 6:47am UTC](https://forums.rockylinux.org/t/activedirectory-integration-problem-in-rocky9/7927/6 "2022-11-24T06:47:14Z")
I experienced this same problem on my organization’s domain. In our case, it was due to a system update on the domain controllers and was fixed with another update – no configuration changes were needed on the RL 8.x/9.x systems. I’m not a domain admin and was not involved with the fix, but I believe this is the relevant link: > **[Windows message center](https://learn.microsoft.com/en-us/windows/release-health/windows-message-center#2961)** > > Windows message center * * * With `debug_level=10` set in the SSSD config file, `/var/log/sssd/ldap_child.log` gave details on the encryption types: ```auto (2022-11-16 12:42:03): [ldap_child[10116]] [sss_child_krb5_trace_cb] (0x4000): [10116] 1668624123.409082: Looked up etypes in keytab: aes128-cts, aes256-cts ``` These _matched_ the types encoded for in `msDS-SupportedEncryptionTypes` attribute of the affected computer objects in AD (0x18) and our systems were using the default crypto policies. The original update(s) that caused the problem were in response to CVE-2022-37966 and CVE-2022-37967. One of the updates was intended to disable RC4, but it ended up breaking things that _only_ supported AES. ---
**Author:** ![dragz](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@dragz](https://forums.rockylinux.org/u/dragz)\ **Post date:** [November 30, 2022, 2:54pm UTC](https://forums.rockylinux.org/t/activedirectory-integration-problem-in-rocky9/7927/7 "2022-11-30T14:54:05Z")
Hi, and thanks for all the help. You put me on the right track! It is indeed an issue with support for older encryption types. The solution for me was to set crypto policy to AD-SUPPORT-LEGACY and rejoining the domain. update-crypto-policy --set DEFAULT:AD-SUPPORT-LEGACY Redhat has a published a piece where I found the solution. (Well, the real solution is for MS to fix the bug in AD so we do not need to support arcfour-hmac) [Red Hat Enterprise Linux and Microsoft security update of November 2022](https://www.redhat.com/en/blog/red-hat-enterprise-linux-and-microsoft-security-update-november-2022) Best regards and thanks for all the help, Roy ---
**Author:** ![brian](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/brian/32/5777_2.png) [@brian](https://forums.rockylinux.org/u/brian)\ **Post date:** [August 25, 2023, 3:32am UTC](https://forums.rockylinux.org/t/activedirectory-integration-problem-in-rocky9/7927/8 "2023-08-25T03:32:34Z")