Need help authenticating linux (Ubuntu) server that is joined to child domain. I can see the server name on the Domain Controller and able to run authentication test successfully however I am not able to login with my domain account. Seems like a config settings somewhere for SSSD or KRB5 config need to specify child domain. Also it is not a domain trust issue since Windows servers joined to child domain are accepting credentials from the parent accounts.
kinit -V user@DOMAIN.SYS
Authenticated to Kerberos v5
root@SERVER:/var/log/sssd# systemctl status sssd
Oct 22 17:55:09 SERVER [sssd[ldap_child[27928]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'SERVER$@DOMAIN.SYS' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection.
ERROR in SSSD log file
Fri Oct 22 17:32:51 2021) [sssd[be[DOMAIN.SYS]]] [confdb_get_domain_internal] (0x0010): Unknown domain [CHILD.DOMAIN.SYS]
(Fri Oct 22 17:32:51 2021) [sssd[be[DOMAIN.SYS]]] [confdb_get_domains] (0x0010): Error (2 [No such file or directory]) retrieving domain [CHILD.DOMAIN.SYS], skipping!
SSSD CONFIG
root@SERVER:cat /etc/sssd/sssd.conf
[sssd]
services = nss, pam
config_file_version = 2
domains = DOMAIN.SYS, CHILD.DOMAIN.SYS
[nss]
default_shell = /bin/bash
[domain/DOMAIN.SYS]
id_provider = ad
access_provider = ad
override_homedir = /home/%d/%u
ad_hostname = server.child.domain.sys
#ad_server = dc.child.domain.sys
#ad_domain = DOMAIN.SYS
KRB5 CONFIG
root@SERVER: cat /etc/krb5.conf
[libdefaults]
default_realm = DOMAIN.SYS
ticket_lifetime = 24h #
renew_lifetime = 7d
rdns = false
The following krb5.conf variables are only for MIT Kerberos.
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true