There is an Active Directory forrest made up of 4 domains, a root domain root.local and 3 child domains called resource (resource.root.local), companyA (companyA.root.local) and companyB (companyB.root.local).
The machine is joined to the resource domain and we can successfully logon to the machine using an account of the same machine.
The authentication with accounts of the companyA and B domains are not working.
We have added the domains in the krb5.conf:
[libdefaults]
default_realm = RESOURCE.ROOT.LOCAL
dns_lookup_kdc = true
udp_preference_limit = 10
[realms]
RESOURCE.ROOT.LOCAL = {
kdc = RESOURCE.ROOT.LOCAL
admin_server = RESOURCE.ROOT.LOCAL
}
COMPANYA.ROOT.LOCAL = {
kdc = COMPANYA.ROOT.LOCAL
admin_server = COMPANYA.ROOT.LOCAL
}
COMPANYB.ROOT.LOCAL = {
kdc = COMPANYB.ROOT.LOCAL
admin_server = COMPANYB.ROOT.LOCAL
}
[domain_realm]
RESOURCE.ROOT.LOCAL = RESOURCE.ROOT.LOCAL
.RESOURCE.ROOT.LOCAL = RESOURCE.ROOT.LOCAL
COMPANYA.ROOT.LOCAL = COMPANYA.ROOT.LOCAL
.COMPANYA.ROOT.LOCAL = COMPANYA.ROOT.LOCAL
COMPANYB.ROOT.LOCAL = COMPANYB.ROOT.LOCAL
.COMPANYB.ROOT.LOCAL = COMPANYB.ROOT.LOCAL
smb.conf:
[global]
security = ADS
realm = RESOURCE.ROOT.LOCAL
workgroup = RESOURCE
encrypt passwords = yes
idmap config *:range = 16777216-33554431
winbind trusted domains only = no
winbind use default domain = no
kerberos method = secrets and keytab
winbind refresh tickets = yes
template shell = /bin/bash
What can i do to achieve this or how can I troubleshoot?
Thanks