SSSD Integration with Microsoft AD for SSH Key based Login

Question

I have configured SSSD on a linux machine which is connected to a Microsoft AD Forest using Realm.

My End Goal is to Login into CentOS machine using the SSH keys stored in Microsoft AD

Below are Setup Details:

• EC2 Windows for Microsoft AD
• EC2 Amazon Linux with SSSD Configured

I am able to login into the linux machine using the AD Username and Password.

I have now stored the SSH Public keys in the Microsoft AD altSecurityIdentities user attributes as well as sshPublicKeys attribute.

Below are the Config file for SSSD

[sssd]
domains = test.com
config_file_version = 2
services = nss, pam, ssh, sudo
debug_level=10

[domain/test.com]
ad_domain = test.com
ad_server = test.com
krb5_realm = TEST.COM
realmd_tags = manages-system joined-with-samba 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%u
access_provider = ad
#SSH KEY FETCH
ldap_user_extra_attrs = altSecurityIdentities:altSecurityIdentities
ldap_user_ssh_public_key = altSecurityIdentities
ldap_use_tokengroups = True

[nss]
debug_level=10

I am getting below error in the sssd_nsss logs

[sssd[nss]] [cache_req_search_send] (0x0400): CR #476: Object found, but needs to be refreshed.
[sssd[nss]] [cache_req_search_dp] (0x0400): CR #476: Looking up [[email protected]] in data provider
[sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x55bf7f9683e0:3:[email protected]@test.com]
[sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [test.com][0x3][BE_REQ_INITGROUPS][[email protected]:-]
[sssd[nss]] [sbus_add_timeout] (0x2000): 0x55bf80d3c120
[sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x55bf7f9683e0:3:[email protected]@test.com]
[sssd[nss]] [sbus_remove_timeout] (0x2000): 0x55bf80d3c120
[sssd[nss]] [sbus_dispatch] (0x4000): dbus conn: 0x55bf80d27fe0
[sssd[nss]] [sbus_dispatch] (0x4000): Dispatching.
[sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[nss]] [cache_req_common_dp_recv] (0x0040): CR #476: Data Provider Error: 3, 5, Failed to get reply from Data Provider
[sssd[nss]] [cache_req_common_dp_recv] (0x0400): CR #476: Due to an error we will return cached data
[sssd[nss]] [cache_req_search_cache] (0x0400): CR #476: Looking up [[email protected]] in cache
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_callback": 0x55bf80d3bc90

[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_timeout": 0x55bf80d2bb90
[sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d3bc90 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d2bb90 "ldb_kv_timeout"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d3bc90 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_callback": 0x55bf80d3bc90
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_timeout": 0x55bf80d2bb90
[sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d3bc90 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d2bb90 "ldb_kv_timeout"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d3bc90 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_callback": 0x55bf80d43d00
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_timeout": 0x55bf80d41100
[sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d43d00 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_callback": 0x55bf80d46b00
[sssd[nss]] [ldb] (0x4000): Added timed event "ldb_kv_timeout": 0x55bf80d46bd0
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d41100 "ldb_kv_timeout"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d43d00 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d46b00 "ldb_kv_callback"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d46bd0 "ldb_kv_timeout"
[sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d46b00 "ldb_kv_callback"

[sssd[nss]] [cache_req_search_ncache_filter] (0x0400): CR #476: This request type does not support filtering result by negative cache
[sssd[nss]] [cache_req_search_done] (0x0400): CR #476: Returning updated object [[email protected]]
[sssd[nss]] [cache_req_create_and_add_result] (0x0400): CR #476: Found 2 entries in domain test.com
[sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x55bf7f9683e0:3:[email protected]@test.com]
[sssd[nss]] [cache_req_done] (0x0400): CR #476: Finished: Success
[sssd[nss]] [nss_protocol_done] (0x4000): Sending reply: success

The SSSD_SSH logs are below

[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]

When I try to login using ssh using the below command

ssh [email protected]@<IP>

I get the below error

[email protected]@<IP>: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

I have tried below things

• Dig

• id [email protected]

  uid=1277801117(demo_user) gid=1277800513(domain users) groups=1277800513(domain users)

I have tried restarting the SSSD Demon but it did not help as suggested in few forums

Is there a way I can make this work

Answer 1

[sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
[sssd[nss]] [cache_req_common_dp_recv] (0x0040): CR #476: Data Provider Error: 3, 5, Failed to get reply from Data Provider
[sssd[nss]] [cache_req_common_dp_recv] (0x0400): CR #476: Due to an error we will return cached data

This tells you that the data provider is offline and the output you see with the id command is coming from the cache. Please check the SSSD domain log (sssd_*.test.com.log) why the client can't talk to the backend.

Once this is fixed, please verify your ssh_config is setup correctly to fetch the public key from AD. The following options need to be in this file:

AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
AuthorizedKeysCommandUser root

You can verify that the ssh key proxy works as expected by running the tool manually:

# sss_ssh_authorizedkeys demo_user

But again, this will not work until the SSSD data provider can successfully talk to the AD backend.