# Enable SSSD without YAST **URL:** \ **Category:** SLES Configure-Administer\ **Created:** [July 24, 2018, 12:55pm UTC](https://forums.suse.com/t/enable-sssd-without-yast/32720 "2018-07-24T12:55:55Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![exploitationwindows](https://avatars.discourse-cdn.com/v4/letter/e/7c8e57/32.png) [@exploitationwindows](https://forums.suse.com/u/exploitationwindows)\ **Post date:** [July 24, 2018, 12:55pm UTC](https://forums.suse.com/t/enable-sssd-without-yast/32720/1 "2018-07-24T12:55:55Z")
Hi everyone, I’m working on SLES 12 SP2 and I want to script the ActiveDirectory integration with using SSSD. I can fill the configuration files without problem and join the domain with the command “net ads join”. It’s not working well until I open YAST and go to : “Network Services” \> “User Logon Management” \> “Change Settings”, here I need to check “Allow Domain User Logon”. If I don’t do that my AD User can not log in to my server. I do not find the parameter to do this in a configuration file or something. The auth-client module is not interactive. I checked this file /usr/share/YaST2/lib/auth/authconf.rb but i do not see what the “Allow Domain User Logon” do. Thank you all. ---
**Author:** ![Automatic\_Reply](https://avatars.discourse-cdn.com/v4/letter/a/ecb155/32.png) [@Automatic\_Reply](https://forums.suse.com/u/Automatic_Reply)\ **Post date:** [July 30, 2018, 7:30am UTC](https://forums.suse.com/t/enable-sssd-without-yast/32720/2 "2018-07-30T07:30:14Z")
Exploitationwindows, It appears that in the past few days you have not received a response to your posting. That concerns us, and has triggered this automated reply. These forums are peer-to-peer, best effort, volunteer run and that if your issue is urgent or not getting a response, you might try one of the following options: - Visit [http://www.suse.com/support](http://www.suse.com/support) and search the knowledgebase and/or check all the other support options available. - Open a service request: [https://www.suse.com/support](https://www.suse.com/support) - You could also try posting your message again. Make sure it is posted in the correct newsgroup. ([http://forums.suse.com](http://forums.suse.com)) Be sure to read the forum FAQ about what to expect in the way of responses: [http://forums.suse.com/faq.php](http://forums.suse.com/faq.php) If this is a reply to a duplicate posting or otherwise posted in error, please ignore and accept our apologies and rest assured we will issue a stern reprimand to our posting bot… Good luck! Your SUSE Forums Team [http://forums.suse.com](http://forums.suse.com) ---
**Author:** ![smflood](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/smflood/32/10576_2.png) [@smflood](https://forums.suse.com/u/smflood)\ **Post date:** [July 30, 2018, 3:29pm UTC](https://forums.suse.com/t/enable-sssd-without-yast/32720/3 "2018-07-30T15:29:57Z")
On 24/07/18 11:04, exploitationwindows wrote: [color=blue] > I’m working on SLES 12 SP2 and I want to script the ActiveDirectory > integration with using SSSD. > > I can fill the configuration files without problem and join the domain > with the command “net ads join”. > > It’s not working well until I open YAST and go to : > “Network Services” \> “User Logon Management” \> “Change Settings”, here I > need to check “Allow Domain User Logon”. > > If I don’t do that my AD User can not log in to my server. I do not find > the parameter to do this in a configuration file or something. > The auth-client module is not interactive. I checked this file > /usr/share/YaST2/lib/auth/authconf.rb but i do not see what the “Allow > Domain User Logon” do.[/color] Does [https://www.suse.com/c/the-sssd-active-directory-and-sles-12-and-15/](https://www.suse.com/c/the-sssd-active-directory-and-sles-12-and-15/) help? ## HTH. Simon SUSE Knowledge Partner * * * ## If you find this post helpful and are logged into the web interface, please show your appreciation and click on the star below. Thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [August 8, 2018, 10:45am UTC](https://forums.suse.com/t/enable-sssd-without-yast/32720/4 "2018-08-08T10:45:16Z")
On 07/24/2018 12:04 PM, exploitationwindows wrote:[color=blue] > I’m working on SLES 12 SP2 and I want to script the ActiveDirectory > integration with using SSSD. > > I can fill the configuration files without problem and join the domain > with the command “net ads join”. > > It’s not working well until I open YAST and go to : > “Network Services” \> “User Logon Management” \> “Change Settings”, here I > need to check “Allow Domain User Logon”. > > If I don’t do that my AD User can not log in to my server. I do not find > the parameter to do this in a configuration file or something.[/color] Did you check the following files and folders before and after the “net ads join” command as well as before and after YaST doing it’s magic? Nsswitch configuration: /etc/nsswitch.conf Pam configuration: /etc/pam.d/ SSSD configuration: /etc/sssd\* It might also be worth comparing the computer object in AD for a system that allows user logon with one that doesn’t. Maybe an attribute is missing there that is created or configured with the YaST module. My currently prefered method is to prepare the sssd configuration files automatically and then running the YaST module interactively. Just for a few servers this is the fasted method for me. In case you do not succeed in replacing YaST with your own script running AutoYaST on the installed system just for the AD integration might also be an option for fast deployment on many servers. Günther ---
**Author:** ![Lawrence1](https://avatars.discourse-cdn.com/v4/letter/l/e56c9b/32.png) [@Lawrence1](https://forums.suse.com/u/Lawrence1)\ **Post date:** [August 8, 2018, 4:56pm UTC](https://forums.suse.com/t/enable-sssd-without-yast/32720/5 "2018-08-08T16:56:07Z")
exploitationwindows, It is likely the bits you’re missing are the pam module and nsswitch file configuration YaST is doing (in addition to some other bits): From the referenced blog post (as the author I can scrape from it 🙂 ): Modify the passwd and group sources in the Name Service Switch configuration file (/etc/nsswitch.conf) to reference the SSSD when resolving users and groups. passwd: compat sss group: compat sss Configure the Pluggable Authentication Module (PAM) configuration on the SLES host to authenticate users using the SSSD, and create home directories for them on login if they do not already exist. ~# pam-config –add –sss ~# pam-config –add –mkhomedir The join and configuration of the SSSD is completely script-able if you know the bits to script 🙂 . Hoping to have helped, – lawrence