# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = true
 dns_lookip_dkc = true
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = true
 default_realm = SILAR.LOCAL
 default_keytab_name = FILE:/etc/krb5.keytab
 default_ccache_name = KEYRING:persistent:%{uid}

 dns_lookup_kdc = true
[realms]
# EXAMPLE.COM = {
#  kdc = kerberos.example.com
#  admin_server = kerberos.example.com
# }

 SILAR.LOCAL = {
  kdc = SrvE2.silar.local
  admin_server = SrvE2
  default_domian = SILAR.LOCAL
 }

 SILAR.LOCAL = {
  kdc = SrvE2.silar.local
  admin_server = SrvE2
 }

[domain_realm]
.silar.local = SILAR.LOCAL
silar.local = SILAR.LOCAL

[appdefaults]
pam = {
    debug = false
    ticket_lifetime = 36000
    renew_lifetime = 36000
    forwardable = true
    krb4_convert = false
}

# See smb.conf.example for a more detailed config file or
# read the smb.conf manpage.
# Run 'testparm' to verify the config is correct after
# you modified it.


[global]

   interfaces = lo enp6s0
idmap config SILAR : range = 2000000-29999999
idmap config SILAR : backend = rid
idmap config * : range = 10000-999999
idmap config * : backend = tdb
template homedir = /home/%U
template shell = /bin/bash
kerberos method = system keytab
   dedicated keytab file = /etc/krb5.keytab
security = user
#   map to guest = Bad User
   map acl inherit = Yes 
   vfs objects = acl_xattr

	passdb backend = tdbsam

	printing = cups
	printcap name = cups
	load printers = yes
	cups options = raw
winbind use default domain = yes
winbind refresh tickets = yes
winbind offline logon = yes
winbind enum groups = no
winbind enum users = no


[printers]
	comment = All Printers
	path = /var/tmp
	printable = Yes
	create mask = 0600
	browseable = No

[print$]
	comment = Printer Drivers
	path = /var/lib/samba/drivers
	write list = root
	create mask = 0664
	directory mask = 0775

#[Projects]
#	browsable = yes
#	comment = shared
#	path = /opt/shared/Projects
#	valid users = %S, %D%W%S, @SILAR\vydrevitch, @SILAR\agp, @SILAR\chepilko
#	force group = @"SILAR\domain users"
#	writable = Yes
#	read only = No
#	force create mode = 0660
#	create mask = 2775
#	directory mask = 2775
#	access based share enum = Yes
#	hide unreadable = Yes
#	inherit acls = Yes


#	browsable = yes
#	guest ok = yes
#	public = yes
#	force user = vydrevitch

[Projects]
	browsable = yes
	comment = shared
	path = /opt/shared/Projects
	force user = agp
	force group = projects
	valid users = @"SILAR@g_calibre"
#	write list = @"SILAR~g_calibre"
#	valid users = SILAR~vydrevitch, SILAR~agp, chepilko
	writable = yes
	read only = no
	force create mode = 0770
	create mask = 6775
	directory mask = 6775
	access based share enum = Yes
	hide unreadable = Yes

systemctl status sssd
● sssd.service - System Security Services Daemon
   Loaded: loaded (/usr/lib/systemd/system/sssd.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Tue 2019-01-22 23:59:26 MSK; 7s ago
  Process: 22364 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER} (code=exited, status=4)
 Main PID: 22364 (code=exited, status=4)

Jan 22 23:59:26 design-serv systemd[1]: Starting System Security Services Daemon...
Jan 22 23:59:26 design-serv sssd[22364]: SSSD couldn't load the configuration database [2]: No such file or directory.
Jan 22 23:59:26 design-serv systemd[1]: sssd.service: main process exited, code=exited, status=4/NOPERMISSION
Jan 22 23:59:26 design-serv systemd[1]: Failed to start System Security Services Daemon.