I use hosts in 2 AD domains -- PROD.MYDOM.COM and NONPROD.MYDOM.COM -- that are part of a "MYDOM.COM" forest.
I used sssd to connect to the NONPROD domain, and logging into that domain works fine. Logging into PROD does not seem possible... Better, this behavior started after updating a host from RHEL 8.0 to 8.6...
I switched to using the "simple" access provider to eliminate some issues. So I have this sssd.conf:
[sssd]
domains = NONPROD.MYDOM.COM
config_file_version = 2
services = nss, pam
[domain/NONPROD.MYDOM.COM]
ad_domain = NONPROD.MYDOM.COM
krb5_realm = NONPROD.MYDOM.COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = simple
Logging in as user1@NONPROD.MYDOM.COM works without a hitch, but if I try to log in as user2@PROD.MYDOM.COM it fails. I can become that user using sudo su - user2@PROD.MYDOM.COM.
This started the first oddity: Why is my home directory user2@MYDOM.COM?
When I do getent passwd user2@PROD.MYDOM.COM, I get this:
user2@MYDOM.COM:*:1852414410:1852414410:user2:/home/user2@MYDOM.COM:/bin/bash
RHEL 8.0 didn't seem to do this, so what's happening? Do I need to explicitly join both domains? That seems extreme.