title: SSSD Integration with Microsoft AD for SSH Key based Login
body: <p>I have configured SSSD on a linux machine which is connected to a Microsoft AD Forest using Realm.</p>
  <p>My End Goal is to Login into CentOS machine using the SSH keys stored in Microsoft AD</p>
  <p>Below are Setup Details:</p>
  <ul>
  <li>EC2 Windows for Microsoft AD</li>
  <li>EC2 Amazon Linux with SSSD Configured</li>
  </ul>
  <p>I am able to login into the linux machine using the AD Username and Password.</p>
  <p>I have now stored the SSH Public keys in the Microsoft AD <strong>altSecurityIdentities</strong> user attributes as well as <strong>sshPublicKeys</strong> attribute.</p>
  <p>Below are the Config file for SSSD</p>
  <pre><code>[sssd]
  domains = test.com
  config_file_version = 2
  services = nss, pam, ssh, sudo
  debug_level=10
  
  [domain/test.com]
  ad_domain = test.com
  ad_server = test.com
  krb5_realm = TEST.COM
  realmd_tags = manages-system joined-with-samba 
  cache_credentials = True
  id_provider = ad
  krb5_store_password_if_offline = True
  default_shell = /bin/bash
  ldap_id_mapping = True
  use_fully_qualified_names = False
  fallback_homedir = /home/%u
  access_provider = ad
  #SSH KEY FETCH
  ldap_user_extra_attrs = altSecurityIdentities:altSecurityIdentities
  ldap_user_ssh_public_key = altSecurityIdentities
  ldap_use_tokengroups = True
  
  [nss]
  debug_level=10
  </code></pre>
  <p>I am getting below error in the sssd_nsss logs</p>
  <pre><code>[sssd[nss]] [cache_req_search_send] (0x0400): CR #476: Object found, but needs to be refreshed.
  [sssd[nss]] [cache_req_search_dp] (0x0400): CR #476: Looking up [demo_user@test.com] in data provider
  [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x55bf7f9683e0:3:demo_user@test.com@test.com]
  [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [test.com][0x3][BE_REQ_INITGROUPS][name=demo_user@test.com:-]
  [sssd[nss]] [sbus_add_timeout] (0x2000): 0x55bf80d3c120
  [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x55bf7f9683e0:3:demo_user@test.com@test.com]
  [sssd[nss]] [sbus_remove_timeout] (0x2000): 0x55bf80d3c120
  [sssd[nss]] [sbus_dispatch] (0x4000): dbus conn: 0x55bf80d27fe0
  [sssd[nss]] [sbus_dispatch] (0x4000): Dispatching.
  [sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
  [sssd[nss]] [cache_req_common_dp_recv] (0x0040): CR #476: Data Provider Error: 3, 5, Failed to get reply from Data Provider
  [sssd[nss]] [cache_req_common_dp_recv] (0x0400): CR #476: Due to an error we will return cached data
  [sssd[nss]] [cache_req_search_cache] (0x0400): CR #476: Looking up [demo_user@test.com] in cache
  [sssd[nss]] [ldb] (0x4000): Added timed event &quot;ldb_kv_callback&quot;: 0x55bf80d3bc90
  
  [sssd[nss]] [ldb] (0x4000): Added timed event &quot;ldb_kv_timeout&quot;: 0x55bf80d2bb90
  [sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d3bc90 &quot;ldb_kv_callback&quot;
  [sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d2bb90 &quot;ldb_kv_timeout&quot;
  [sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d3bc90 &quot;ldb_kv_callback&quot;
  [sssd[nss]] [ldb] (0x4000): Added timed event &quot;ldb_kv_callback&quot;: 0x55bf80d3bc90
  [sssd[nss]] [ldb] (0x4000): Added timed event &quot;ldb_kv_timeout&quot;: 0x55bf80d2bb90
  [sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d3bc90 &quot;ldb_kv_callback&quot;
  [sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d2bb90 &quot;ldb_kv_timeout&quot;
  [sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d3bc90 &quot;ldb_kv_callback&quot;
  [sssd[nss]] [ldb] (0x4000): Added timed event &quot;ldb_kv_callback&quot;: 0x55bf80d43d00
  [sssd[nss]] [ldb] (0x4000): Added timed event &quot;ldb_kv_timeout&quot;: 0x55bf80d41100
  [sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d43d00 &quot;ldb_kv_callback&quot;
  [sssd[nss]] [ldb] (0x4000): Added timed event &quot;ldb_kv_callback&quot;: 0x55bf80d46b00
  [sssd[nss]] [ldb] (0x4000): Added timed event &quot;ldb_kv_timeout&quot;: 0x55bf80d46bd0
  [sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d41100 &quot;ldb_kv_timeout&quot;
  [sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d43d00 &quot;ldb_kv_callback&quot;
  [sssd[nss]] [ldb] (0x4000): Running timer event 0x55bf80d46b00 &quot;ldb_kv_callback&quot;
  [sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d46bd0 &quot;ldb_kv_timeout&quot;
  [sssd[nss]] [ldb] (0x4000): Destroying timer event 0x55bf80d46b00 &quot;ldb_kv_callback&quot;
  
  [sssd[nss]] [cache_req_search_ncache_filter] (0x0400): CR #476: This request type does not support filtering result by negative cache
  [sssd[nss]] [cache_req_search_done] (0x0400): CR #476: Returning updated object [demo_user@test.com]
  [sssd[nss]] [cache_req_create_and_add_result] (0x0400): CR #476: Found 2 entries in domain test.com
  [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x55bf7f9683e0:3:demo_user@test.com@test.com]
  [sssd[nss]] [cache_req_done] (0x0400): CR #476: Finished: Success
  [sssd[nss]] [nss_protocol_done] (0x4000): Sending reply: success
  </code></pre>
  <p>The SSSD_SSH logs are below</p>
  <pre><code>[sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
  [sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
  [sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
  [sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
  [sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
  [sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
  [sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
  [sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
  [sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
  [sssd[ssh]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]
  </code></pre>
  <p>When I try to login using ssh using the below command</p>
  <pre><code>ssh demo_user@test.com@&lt;IP&gt;
  </code></pre>
  <p>I get the below error</p>
  <pre><code>demo_user@test.com@&lt;IP&gt;: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
  </code></pre>
  <p>I have tried below things</p>
  <ul>
  <li><p>Dig
  <a href="https://i.stack.imgur.com/QMqSC.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QMqSC.png" alt="enter image description here" /></a></p>
  </li>
  <li><p>id demo_user@test.com</p>
  <p>uid=1277801117(demo_user) gid=1277800513(domain users) groups=1277800513(domain users)</p>
  </li>
  </ul>
  <p>I have tried restarting the SSSD Demon but it did not help as suggested in few forums</p>
  <p>Is there a way I can make this work</p>