Hi,
We are trying to use Active Directory site discovery feature for our SSSD configurations. Our Domain Controllers are running on Windows 2016 / 2019 OS. We are not joining our Linux machines to AD Domain and use following sssd domain configurations.
[domain/default] auth_provider = krb5 cache_credentials = True chpass_provider = krb5 dns_discovery_domain = NORWAY._sites.AD.MYDOMAIN.COM debug_level = 7 enumerate = False id_provider = ldap krb5_realm = AD.MYDOMAIN.COM ldap_default_authtok = xxxx ldap_default_authtok_type = obfuscated_password ldap_default_bind_dn = xxxx ldap_schema = ad ldap_search_base = ou=base,dc=ad,dc=mydomain,dc=com use_fully_qualified_names = False ldap_id_mapping = True default_shell = /bin/bash ldap_tls_cacertdir = /etc/openldap/certs ldap_user_fullname = displayName ldap_user_gecos = displayName ldap_user_objectsid = objectSid ldap_group_objectsid = objectSid ldap_use_tokengroups = False ignore_group_members = true
Here with site discovery, it is able to find the nearest domain controller but it is trying to connect with LDAP server on port 389. Our domain controllers are only allowing connections on port 636 so the requests from linux servers are getting rejected.
If I directly configure domain controller names in ldap_uri settings like below and remove site discover configurations, everything is working fine. ldap_uri = ldaps://mydc.mydomain.com
But we don't want to hard code our domain controllers in configurations. Is there a way to use AD site discovery feature with ldaps?
Thanks for your time.
Regards, //Vjay