Cant log into rocky8.7 with domain credentials

Rocky Linux General
1

I cant log into my rockylinux 8.7 build with my samba4 domain user credentials.
If i ssh as root and then su as my user then its fine. I can see my automounts from the domain fine.
The system joins the domain correctly with adcli join london.company.com

The sssd service is running . But I see update failed:NOTAUTH

sssd.conf file is
[sssd]
domains = london.company.com
config_file_version = 2
services = nss, pam, autofs
default_domain_suffix = london.company.com

[domain/london.company.com]
ad_domain = london.company.com
krb5_realm = LONDON.COMPANY.COM
realmd_tags = manages-system joined-with-samba
#cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
full_name_format = %1$s

[autofs]
#autofs_provider=ldap
#ldap_autofs_search_base=CN=london,CN=defaultMigrationContainer30,DC=london,DC=company,DC=com
#ldap_autofs_map_object_class=nisMap
#ldap_autofs_entry_object_class=nisObject
#ldap_autofs_map_name=nisMapName
#ldap_autofs_entry_key=cn
#ldap_autofs_entry_value=nisMapEntry

This sssd config works fine on centos7.9. What could have changed?

2

You may want to try using realm join instead of adcli. It could easily fill in the pieces that you are missing. realm will make changes you need while adcli does not (for example changes to pam, nsswitch, a starting sssd.conf).

If you find that it is still not working after, you need to put sssd into debug mode and investigate further. See here.

3

that just says
realm: Already joined to this domain
Please check
Basic Prechecks Steps: RHEL Join With Active Directory using 'adcli', 'realm' and 'net' commands - Red Hat Customer Portal
to get help for common issues.

4

I disjoined the domain and re joined using realm and this time my terminal cursor started display my login with the workstations fullly qualified name rather than short name.

Im rebooting to see after realm join will it work after reboot.

5

ran this command
authselect select -f sssd
In: etc/pam.d/system-auth
adds 1

session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid

I can now login with my domain users

6

I can login fine with my domain user account but I still notice in the service status for sssd. I see

update failed: NOTAUTH
update failed: NOTAUTH
update failed: NOTAUTH
update failed: NOTAUTH

7

I did notice when a user is logged in for some some it shows at GSSAPI client step 1 three times under update failed: NOTAUTH.

8

adcli[14056]: GSSAPI client step 1

9

Why don’t you do realm join with a stock sssd configure and then change it once you are able to login.
Also, you may need to login using username@london.company.com or something similar

10

That is to much work. I need it all automated so that when a user sitsc in front of a system they don’t need to faff around with changing usernames from fully qualified to shortform. I wantv to be able to just kickstart it and at the end the user sits in frontb of the system and logs in.