SSSD ActiveDirectory SSH SSO не работает

У меня очень хорошо работает SSO Setup для Ubuntu 14.04. К сожалению, моя установка не работает с Ubuntu 16.04, и я понятия не имею, почему.

Я использую sssd-ad в сочетании с ssh для единого входа, моя проблема в том, что автоматический вход не работает - я всегда получаю запрос пароля, и с моим паролем я могу войти, но это не цель ссо ...

krb5.conf

 [libdefaults]
 default_realm = MY.DOMAIN.LOC
 dns_lookup_realm = true
 dns_lookup_kdc = true
 dns_fallback = yes

 ticket_lifetime = 24h
 renew_lifetime = 7d
 default_tkt_enctypes = aes256-cts-hmac-sha1-96
 default_tgs_enctypes = aes256-cts-hmac-sha1-96
 rdns = false

 ignore_acceptor_hostname = true  # Needed with 16.04 - else I get the error: Unspecified GSS failure.  Minor code may provide more information\nNo key table entry found matching host/HOSTNAME@ 

sssd.conf

[sssd]
domains = MY.DOMAIN.LOC
config_file_version = 2
services = nss, pam

[domain/MY.DOMAIN.LOC]
#debug_level = 0x0200
id_provider = ad
access_provider = ad

ad_domain = MY.DOMAIN.LOC
krb5_realm = MY.DOMAIN.LOC

# Uncomment if the client machine hostname doesn't match the computer object on the DC.
# ad_hostname = HOSTNAME.MY.DOMAIN.LOC

# Uncomment if DNS SRV resolution is not working
# ad_server = DC.MY.DOMAIN.LOC

realmd_tags = manages-system joined-with-adcli
cache_credentials = True
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False

fallback_homedir = /home/%d/%u

ad_access_filter = FOREST:MY.DOMAIN.LOC:(memberOf:1.2.840.113556.1.4.1941:=CN=RES Linux Login,OU=MGMGroups,DC=MY,DC=DOMAIN,DC=LOC)

/ и т.д. / SSH / sshd_config

Port 22
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 4096
SyslogFacility AUTH
LogLevel DEBUG3
LoginGraceTime 120
PermitRootLogin prohibit-password
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server

ChallengeResponseAuthentication yes
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
UsePAM yes
Ciphers +3des-cbc
HostKeyAlgorithms +ssh-dss
# Needed for Backup in Ubuntu 16.04
KexAlgorithms +diffie-hellman-group1-sha1

С помощью этой настройки я могу подключиться к одному из моих серверов Ubuntu 14.04 с одной из рабочих станций, присоединенных к моему домену, через SSH (GSSAPI).

Журналы SSH - Debuglevel3

Client protocol version 2.0; client software version PuTTY_Release_0.65
Enabling compatibility mode for protocol 2.0
Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.1
list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
KEX algorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 [preauth]
userauth-request for user USERNAME service ssh-connection method none [preauth]
input_userauth_request: try method none [preauth]
userauth_finish: failure partial=0 next methods="publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive" [preauth]
PAM: initializing for "USERNAME"
PAM: setting PAM_RHOST to "10.99.99.99"
PAM: setting PAM_TTY to "ssh"
userauth-request for user USERNAME service ssh-connection method gssapi-with-mic [preauth]
attempt 1 failures 0 [preauth]
input_userauth_request: try method gssapi-with-mic [preauth]
mm_request_send entering: type 42 [preauth]
mm_request_receive_expect entering: type 43 [preauth]
mm_request_receive entering [preauth]
mm_request_receive entering
monitor_read: checking request 42
mm_request_send entering: type 43
send packet: type 60 [preauth]
Postponed gssapi-with-mic for USERNAME from 10.99.99.99 port 65071 ssh2 [preauth]
receive packet: type 50 [preauth]
userauth-request for user USERNAME service ssh-connection method keyboard-interactive [preauth]
attempt 2 failures 0 [preauth]
input_userauth_request: try method keyboard-interactive [preauth]
keyboard-interactive devs  [preauth]
auth2_challenge: user=USERNAME devs= [preauth]
kbdint_alloc: devices 'pam' [preauth]
auth2_challenge_start: devices pam [preauth]
kbdint_next_device: devices <empty> [preauth]
auth2_challenge_start: trying authentication method 'pam' [preauth]
mm_sshpam_init_ctx [preauth]
mm_request_send entering: type 104 [preauth]
mm_sshpam_init_ctx: waiting for MONITOR_ANS_PAM_INIT_CTX [preauth]
mm_request_receive_expect entering: type 105 [preauth]
mm_request_receive entering [preauth]
mm_request_receive entering
monitor_read: checking request 104
mm_answer_pam_init_ctx
PAM: sshpam_init_ctx entering
mm_request_send entering: type 105
mm_sshpam_query [preauth]
mm_request_send entering: type 106 [preauth]
mm_sshpam_query: waiting for MONITOR_ANS_PAM_QUERY [preauth]
mm_request_receive_expect entering: type 107 [preauth]
mm_request_receive entering [preauth]
mm_request_receive entering
monitor_read: checking request 106
mm_answer_pam_query
PAM: sshpam_query entering
ssh_msg_recv entering
PAM: sshpam_thread_conv entering, 1 messages
ssh_msg_send: type 1
ssh_msg_recv entering
mm_request_send entering: type 107
mm_sshpam_query: pam_query returned 0 [preauth]
send packet: type 60 [preauth]
Postponed keyboard-interactive for USERNAME from 10.99.99.99 port 65071 ssh2 [preauth]

Есть идеи, почему "ignore_acceptor_hostname" нужен в ubuntu 16.04? Я не вижу причины, по которой это не работает, не знаю, в чем может быть причина или как я могу получить хорошее сообщение об ошибке?