使用Ansible集成AD域至RHEL9.4时无法创建用户家目录

已成功将RedHat 9.4服务器集成到lab.local域，域用户可正常登录，但无法自动在/home/%u路径创建用户家目录，报错信息如下：

Could not chdir to home directory /home/trio01: No such file or directory

集成所用Ansible剧本 #

- hosts: all
  become: yes
  vars:
    pkgs:
      - sssd
      - sssd-tools
      - sssd-ldap
      - sssd-ad
      - adcli
      - realmd
      - krb5-workstation
      - openldap-clients
      - cyrus-sasl-gssapi
      - oddjob
      - oddjob-mkhomedir

    AD_Domain: LAB.LOCAL
    AD_Domain_alt: lab.local
    Join_OU: OU=Linux,DC=LAB,DC=LOCAL
    SRV_ADM_GRP_OU: OU=Linux,DC=lab,DC=local

  vars_prompt:
    - name: username
      prompt: "请输入AD管理员用户名？"
      private: no
    - name: password
      prompt: "请输入AD管理员密码？"
      private: yes
    - name: adhostname
      prompt: "请输入机器短名称，不要FQDN格式"
      private: no


  tasks:
  - name: 检查服务器发行版本（仅支持RedHat）
    fail:
      msg: 系统不是RedHat，终止执行
    when: ansible_facts['distribution'] != 'RedHat'

      # - name: 安装加入AD域所需的软件包
      # yum: name={{ pkgs }} state=present update_cache=yes

  - name: 配置机器名称
    shell: hostnamectl set-hostname {{ adhostname }}.{{ AD_Domain_alt }}

  - name: 加入AD域（创建AD计算机账户并更新/etc/krb5.keytab文件）
    shell: echo '{{ password }}' | adcli join --stdin-password {{ AD_Domain }} -v -U {{ username }} --domain-ou={{ Join_OU }}

  - name: 配置sssd.conf文件
    template:
      src: sssd.j2
      dest: /etc/sssd/sssd.conf
      owner: root
      group: root
      mode: 0600

  - name: 配置PAM自动创建家目录规则
    lineinfile:
     path: /etc/pam.d/common-session
     line: 'session required pam_mkhomedir.so skel=/etc/skel umask=0077'
     create: yes

  - name: 确保oddjobd服务启用并启动
    service:
     name: oddjobd
     enabled: yes
     state: started
  - name: 配置nsswitch.conf文件
    lineinfile:
      path: /etc/nsswitch.conf
      regexp: "{{ item.regexp }}"
      line: "{{ item.line }}"
    loop:
      - regexp: '^passwd:'
        line: 'passwd:   compat sss'
      - regexp: '^group:'
        line: 'group:   compat sss'
      - regexp: '^services:'
        line: 'services:   files sss'
      - regexp: '^sudoers:'
        line: 'sudoers:   files sss'

  - name: 允许AD中的Linux管理员组登录Linux服务器
    shell: realm permit -g adminlinux@lab.Local

  - name: 将Linux管理员组添加到sudoers
    lineinfile:
       dest: /etc/sudoers
       line: "%adminlinux@lab.local"   ALL=(ALL) ALL
       insertafter: '^%wheel'

  - name: 配置krb5.conf文件
    template:
      src: krb5.j2
      dest: /etc/krb5.conf
      owner: root
      group: root
      mode: 0644

  - name: 配置ldap.conf客户端文件
    template:
      src: ldap.j2
      dest: /etc/openldap/ldap.conf
      owner: root
      group: root
      mode: 0644

  - name: 重启realmd服务
    systemd:
     name: realmd
     enabled: yes
     state: restarted

  - name: 重启sssd服务
    systemd:
     name: sssd
     enabled: yes
     state: restarted
    become: yes
    become_user: root

sssd.j2配置文件 #

[sssd]
domains = {{ AD_Domain }}
config_file_version = 2
services = nss, pam, sudo, ssh
default_domain_suffix = {{ AD_Domain }}

[nss]
filter_users = root
filter_groups = root

[pam]
pam_mkhomedir = True

[sudo]

[domain/{{ AD_Domain }}]
id_provider = ad
auth_provider = ad
access_provider = ad
chpass_provider = ad
ad_domain = {{ AD_Domain }}
realmd_tags = manages-system joined-with-adcli
cache_credentials = false
default_shell = /bin/bash
create_homedir = true
override_homedir = /home/%u
ldap_referrals = false
ldap_schema = ad
krb5_realm = {{ AD_Domain }}
dyndns_update = true
dyndns_refresh_interval = 43200
dyndns_update_ptr = true
dyndns_ttl = 3600
dyndns_auth = GSS-TSIG
enumerate = false
use_fully_qualified_names = true
skel_dir = /etc/skel
ldap_id_mapping = true
auto_private_groups = true
sudo_provider = ad
simple_allow_groups = %adminlinux@lab.local
ad_gpo_access_control = permissive

[global]
krb5_auth = yes

内容的提问来源于stack exchange，提问作者oussama_tr