Авторизация в Active Directory через ssh

auth    sufficient      pam_ldap.so
account sufficient      pam_permit.so

auth        required      pam_env.so
auth		required	pam_krb5.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account		required	pam_krb5.so
account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password	sufficient	pam_krb5.so use_authok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session		sufficient	pam_krb5.so

Feb  5 14:22:44 ad-centos-1 login: pam_krb5[1735]: error resolving user name 'user01' to uid/gid pair
Feb  5 14:22:44 ad-centos-1 login: pam_krb5[1735]: error getting information about 'user01'
Feb  5 14:22:44 ad-centos-1 login: pam_unix(login:auth): check pass; user unknown
Feb  5 14:22:44 ad-centos-1 login: pam_succeed_if(login:auth): error retrieving information about user user01
Feb  5 14:22:46 ad-centos-1 login: FAILED LOGIN 2 FROM (null) FOR user01, User not known to the underlying authentication module

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = AD-CENTOS.LOCAL
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 AD-CENTOS.LOCAL = {
  kdc = AD-CENTOS.LOCAL
  admin_server = AD-CENTOS.LOCAL
 }

[domain_realm]
 .AD-CENTOS.LOCAL = AD-CENTOS.LOCAL
 AD-CENTOS.LOCAL = AD-CENTOS.LOCAL

# kinit -V user01
Using default cache: /tmp/krb5cc_0
Using principal: user01@AD-CENTOS.LOCAL
Password for user01@AD-CENTOS.LOCAL: 
Authenticated to Kerberos v5

...
passwd:   compat winbind
group:    compat winbind
shadow:   compat
...

@include common-auth

auth	[success=2 default=ignore]	pam_unix.so nullok_secure
auth	[success=1 default=ignore]	pam_winbind.so <кучапараметров>

...
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_sss.so use_first_pass
auth        required      pam_deny.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so
...

# vim: set filetype=config
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = EXAMPLE 
#debug_level = 3
debug_level = 9

[nss]
filter_groups = root,zabbix,nginx,bacmon
filter_users = root,zabbix,nginx,bacmon
reconnection_retries = 3

# The entry_cache_timeout indicates the number of seconds to retain an
# entry in cache before it is considered stale and must block to refresh.
# The entry_cache_nowait_timeout indicates the number of seconds to
# wait before updating the cache out-of-band. (NSS requests will still
# be returned from cache until the full entry_cache_timeout). Setting this
# value to 0 turns this feature off (default).
#entry_cache_timeout = 600
#entry_cache_nowait_timeout = 300

[pam]
reconnection_retries = 3


[domain/EXAMPLE]
description = example domain
enumerate = False
min_id = 1000
debug_level = 9

access_provider = ldap 
auth_provider = krb5
chpass_provider = krb5
id_provider = ldap


ldap_search_base = dc=example,dc=ru

ldap_tls_cacertdir = /etc/openldap/certs
ldap_schema = rfc2307bis
ldap_default_bind_dn = CN=user,OU=Service accounts,OU=Accounts,DC=example,DC=ru
ldap_default_authtok_type = password
ldap_default_authtok = pwd

#ldap_uri = ldaps://srvdc001.example.ru/, ldaps://srvdc001.example.ru/

ldap_access_filter = memberOf:1.2.840.113556.1.4.1941:=CN=SERVER,OU=UNIX Hosts,OU=Access groups,DC=example,DC=ru

ldap_user_search_base = OU=Accounts,DC=example,DC=ru
ldap_user_object_class = user

ldap_group_search_base = OU=UNIX Groups,OU=Access groups,DC=example,DC=ru
ldap_group_object_class = group


ldap_user_name = sAMAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = unixHomeDirectory
ldap_user_shell = loginShell
ldap_user_principal = userPrincipalName
ldap_group_object_class = group

ldap_force_upper_case_realm = True

cache_credentials = True
ldap_id_use_start_tls = False

#krb5_password = srvdc001.example.ru
#krb5_server = srvdc001.example.ru
krb5_canonicalize = false
krb5_realm = EXAMPLE.RU