部分用户RHEL系统AD集成Kerberos认证失败（SSSD、PAM）

SSSD关键配置（sssd.conf） #

• services = nss,pam
• id_provider = ad
• auth_provider = ad
• access_provider = simple

SSSD PAM日志对比 #

成功登录日志（同事B） #

(2024-09-25 14:50:47): [pam] [pd_set_primary_name] (0x0400): [CID#2] User's primary name is colleague_b@corporate.local
(2024-09-25 14:50:47): [pam] [pam_dp_send_req] (0x0100): [CID#2] Sending request with the following data:
(2024-09-25 14:50:47): [pam] [pam_print_data] (0x0100): [CID#2] command: SSS_PAM_SETCRED
(2024-09-25 14:50:47): [pam] [pam_print_data] (0x0100): [CID#2] domain: corporate.local
(2024-09-25 14:50:47): [pam] [pam_print_data] (0x0100): [CID#2] user: colleague_b@corporate.local
(2024-09-25 14:50:47): [pam] [pam_print_data] (0x0100): [CID#2] service: sshd
(2024-09-25 14:50:47): [pam] [pam_print_data] (0x0100): [CID#2] tty: ssh
(2024-09-25 14:50:47): [pam] [pam_print_data] (0x0100): [CID#2] ruser: not set
(2024-09-25 14:50:47): [pam] [pam_print_data] (0x0100): [CID#2] rhost: 10.20.30.40
(2024-09-25 14:50:47): [pam] [pam_print_data] (0x0100): [CID#2] authtok type: 0 (No authentication token available)
(2024-09-25 14:50:47): [pam] [pam_print_data] (0x0100): [CID#2] newauthtok type: 0 (No authentication token available)
(2024-09-25 14:50:47): [pam] [pam_print_data] (0x0100): [CID#2] priv: 1
(2024-09-25 14:50:47): [pam] [pam_print_data] (0x0100): [CID#2] cli_pid: 2254046
(2024-09-25 14:50:47): [pam] [pam_print_data] (0x0100): [CID#2] child_pid: 0
(2024-09-25 14:50:47): [pam] [pam_print_data] (0x0100): [CID#2] logon name: colleague_b
(2024-09-25 14:50:47): [pam] [pam_print_data] (0x0100): [CID#2] flags: 2
(2024-09-25 14:50:47): [pam] [pam_dom_forwarder] (0x0100): [CID#2] pam_dp_send_req returned 0
(2024-09-25 14:50:47): [pam] [pam_dp_send_req_done] (0x0200): [CID#2] received: [0 (Success)][corporate.local]

登录失败日志（同事A） #

[pam] [pd_set_primary_name] (0x0400): [CID#11] User's primary name is colleague_a@corporate.local
(2024-09-25 12:36:47): [pam] [pam_dp_send_req] (0x0100): [CID#11] Sending request with the following data:
(2024-09-25 12:36:47): [pam] [pam_print_data] (0x0100): [CID#11] command: SSS_PAM_AUTHENTICATE
(2024-09-25 12:36:47): [pam] [pam_print_data] (0x0100): [CID#11] domain: corporate.local
(2024-09-25 12:36:47): [pam] [pam_print_data] (0x0100): [CID#11] user: colleague_a@corporate.local
(2024-09-25 12:36:47): [pam] [pam_print_data] (0x0100): [CID#11] service: sshd
(2024-09-25 12:36:47): [pam] [pam_print_data] (0x0100): [CID#11] tty: ssh
(2024-09-25 12:36:47): [pam] [pam_print_data] (0x0100): [CID#11] ruser: not set
(2024-09-25 12:36:47): [pam] [pam_print_data] (0x0100): [CID#11] rhost: 10.20.30.40
(2024-09-25 12:36:47): [pam] [pam_print_data] (0x0100): [CID#11] authtok type: 1 (Password)
(2024-09-25 12:36:47): [pam] [pam_print_data] (0x0100): [CID#11] newauthtok type: 0 (No authentication token available)
(2024-09-25 12:36:47): [pam] [pam_print_data] (0x0100): [CID#11] priv: 1
(2024-09-25 12:36:47): [pam] [pam_print_data] (0x0100): [CID#11] cli_pid: 2200955
(2024-09-25 12:36:47): [pam] [pam_print_data] (0x0100): [CID#11] child_pid: 0
(2024-09-25 12:36:47): [pam] [pam_print_data] (0x0100): [CID#11] logon name: colleague_a
(2024-09-25 12:36:47): [pam] [pam_print_data] (0x0100): [CID#11] flags: 2
(2024-09-25 12:36:47): [pam] [pam_dom_forwarder] (0x0100): [CID#11] pam_dp_send_req returned 0
(2024-09-25 12:36:47): [pam] [pam_dp_send_req_done] (0x0200): [CID#11] received: [9 (Authentication service cannot retrieve authentication info)][corporate.local]
(2024-09-25 12:36:47): [pam] [pam_reply] (0x0400): [CID#11] Local auth policy allowed: smartcard [False], passkey [True]

补充信息 #

Active Directory中显示，登录失败的同事拥有完全控制权限（有效访问权限验证结果为完全控制）

内容的提问来源于stack exchange，提问作者HDemaiter