# Cant log into rocky8.7 with domain credentials **URL:** \ **Category:** Rocky Linux Help & Support\ **Created:** [February 23, 2023, 5:11pm UTC](https://forums.rockylinux.org/t/cant-log-into-rocky8-7-with-domain-credentials/9007 "2023-02-23T17:11:08Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![limbooface](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@limbooface](https://forums.rockylinux.org/u/limbooface)\ **Post date:** [February 23, 2023, 5:11pm UTC](https://forums.rockylinux.org/t/cant-log-into-rocky8-7-with-domain-credentials/9007/1 "2023-02-23T17:11:08Z")
I cant log into my rockylinux 8.7 build with my samba4 domain user credentials. If i ssh as root and then su as my user then its fine. I can see my automounts from the domain fine. The system joins the domain correctly with adcli join [london.company.com](http://london.company.com) The sssd service is running . But I see update failed:NOTAUTH sssd.conf file is [sssd] domains = [london.company.com](http://london.company.com) config\_file\_version = 2 services = nss, pam, autofs default\_domain\_suffix = [london.company.com](http://london.company.com) [domain/london.company.com] ad\_domain = [london.company.com](http://london.company.com) krb5\_realm = [LONDON.COMPANY.COM](http://LONDON.COMPANY.COM) realmd\_tags = manages-system joined-with-samba #cache\_credentials = True id\_provider = ad krb5\_store\_password\_if\_offline = True default\_shell = /bin/bash ldap\_id\_mapping = False use\_fully\_qualified\_names = True fallback\_homedir = /home/%u@%d access\_provider = ad full\_name\_format = %1$s [autofs] #autofs\_provider=ldap #ldap\_autofs\_search\_base=CN=london,CN=defaultMigrationContainer30,DC=london,DC=company,DC=com #ldap\_autofs\_map\_object\_class=nisMap #ldap\_autofs\_entry\_object\_class=nisObject #ldap\_autofs\_map\_name=nisMapName #ldap\_autofs\_entry\_key=cn #ldap\_autofs\_entry\_value=nisMapEntry This sssd config works fine on centos7.9. What could have changed? ---
**Author:** ![label](https://avatars.discourse-cdn.com/v4/letter/l/c5a1d2/32.png) [@label](https://forums.rockylinux.org/u/label)\ **Post date:** [February 23, 2023, 5:17pm UTC](https://forums.rockylinux.org/t/cant-log-into-rocky8-7-with-domain-credentials/9007/2 "2023-02-23T17:17:38Z")
You may want to try using `realm join` instead of adcli. It could easily fill in the pieces that you are missing. `realm` will make changes you need while `adcli` does not (for example changes to pam, nsswitch, a starting sssd.conf). If you find that it is still not working after, you need to put sssd into debug mode and investigate further. See [here](https://sssd.io/troubleshooting/basics.html). ---
**Author:** ![limbooface](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@limbooface](https://forums.rockylinux.org/u/limbooface)\ **Post date:** [February 23, 2023, 5:56pm UTC](https://forums.rockylinux.org/t/cant-log-into-rocky8-7-with-domain-credentials/9007/3 "2023-02-23T17:56:13Z")
that just says realm: Already joined to this domain Please check [Basic Prechecks Steps: RHEL Join With Active Directory using 'adcli', 'realm' and 'net' commands - Red Hat Customer Portal](https://red.ht/support_rhel_ad) to get help for common issues. ---
**Author:** ![limbooface](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@limbooface](https://forums.rockylinux.org/u/limbooface)\ **Post date:** [February 23, 2023, 6:05pm UTC](https://forums.rockylinux.org/t/cant-log-into-rocky8-7-with-domain-credentials/9007/4 "2023-02-23T18:05:04Z")
I disjoined the domain and re joined using realm and this time my terminal cursor started display my login with the workstations fullly qualified name rather than short name. Im rebooting to see after realm join will it work after reboot. ---
**Author:** ![limbooface](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@limbooface](https://forums.rockylinux.org/u/limbooface)\ **Post date:** [February 23, 2023, 7:48pm UTC](https://forums.rockylinux.org/t/cant-log-into-rocky8-7-with-domain-credentials/9007/5 "2023-02-23T19:48:59Z")
ran this command authselect select -f sssd In: etc/pam.d/system-auth adds 1 session [success=1 default=ignore] pam\_succeed\_if.so service in crond quiet use\_uid I can now login with my domain users ---
**Author:** ![limbooface](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@limbooface](https://forums.rockylinux.org/u/limbooface)\ **Post date:** [February 24, 2023, 3:19pm UTC](https://forums.rockylinux.org/t/cant-log-into-rocky8-7-with-domain-credentials/9007/6 "2023-02-24T15:19:46Z")
I can login fine with my domain user account but I still notice in the service status for sssd. I see update failed: NOTAUTH update failed: NOTAUTH update failed: NOTAUTH update failed: NOTAUTH ---
**Author:** ![limbooface](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@limbooface](https://forums.rockylinux.org/u/limbooface)\ **Post date:** [February 24, 2023, 3:42pm UTC](https://forums.rockylinux.org/t/cant-log-into-rocky8-7-with-domain-credentials/9007/7 "2023-02-24T15:42:39Z")
I did notice when a user is logged in for some some it shows at GSSAPI client step 1 three times under update failed: NOTAUTH. ---
**Author:** ![limbooface](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@limbooface](https://forums.rockylinux.org/u/limbooface)\ **Post date:** [February 24, 2023, 3:43pm UTC](https://forums.rockylinux.org/t/cant-log-into-rocky8-7-with-domain-credentials/9007/8 "2023-02-24T15:43:02Z")
adcli[14056]: GSSAPI client step 1 ---
**Author:** ![lyoth](https://avatars.discourse-cdn.com/v4/letter/l/f19dbf/32.png) [@lyoth](https://forums.rockylinux.org/u/lyoth)\ **Post date:** [March 2, 2023, 2:49am UTC](https://forums.rockylinux.org/t/cant-log-into-rocky8-7-with-domain-credentials/9007/9 "2023-03-02T02:49:04Z")
Why don’t you do realm join with a stock sssd configure and then change it once you are able to login. Also, you may need to login using [username@london.company.com](mailto:username@london.company.com) or something similar ---
**Author:** ![limbooface](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@limbooface](https://forums.rockylinux.org/u/limbooface)\ **Post date:** [March 2, 2023, 7:25pm UTC](https://forums.rockylinux.org/t/cant-log-into-rocky8-7-with-domain-credentials/9007/10 "2023-03-02T19:25:37Z")
That is to much work. I need it all automated so that when a user sitsc in front of a system they don’t need to faff around with changing usernames from fully qualified to shortform. I wantv to be able to just kickstart it and at the end the user sits in frontb of the system and logs in. ---
**Author:** ![brian](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/brian/32/5777_2.png) [@brian](https://forums.rockylinux.org/u/brian)\ **Post date:** [August 25, 2023, 3:23am UTC](https://forums.rockylinux.org/t/cant-log-into-rocky8-7-with-domain-credentials/9007/11 "2023-08-25T03:23:12Z")