CentOS Stream 9 – Common Problem 112 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

realm join with AD fails or SSSD does not start on Stream 9.

Environment & Reproduction

Newer SSSD requires Kerberos canonicalization and matching DNS records.

Root Cause Analysis

krb5.conf, /etc/sssd/sssd.conf or DNS PTR records are out of sync.

Quick Triage

Run realm discover and inspect klist output.

Step-by-Step Diagnosis

Check /var/log/sssd/* for KRB5_TRACE messages.

Solution – Primary Fix

Re-run realm leave then realm join –user=Administrator with correct DNS.

Solution – Alternative Approaches

Use winbind via samba-winbind as a fallback identity provider.

Verification & Acceptance Criteria

id @ resolves UID/GID and ssh login succeeds.

Rollback Plan

Restore /etc/sssd/sssd.conf from backup and sss_cache -E.

Prevention & Hardening

Use ipa-client or AD trust automation in Kickstart.

Related Errors & Cross-Refs

Related: nss_systemd ordering and pam_sss missing in /etc/pam.d.

Related tutorial: View the step-by-step tutorial for centos-stream-9.

View all centos-stream-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Red Hat ‘Integrating RHEL systems directly with Windows Active Directory’.