I'm setting up new Ubuntu 26 servers with SSSD and Active Directory. Authentication works when I use a fully qualified or otherwise adjusted username, but SSH connections from Windows fail with "Permission denied" when the client automatically sends the account in the form DOMAINname.surname.
On Ubuntu 24, the same general SSSD setup worked without requiring users to modify their SSH command. The Windows OpenSSH client is generating the username format automatically, and I'd prefer not to make less-technical users remember to add a different prefix or suffix.
The relevant SSSD settings include the AD identity provider, cached credentials, `use_fully_qualified_names = False`, `access_provider = simple`, and an allowlist of permitted groups. Is there a configuration change or compatibility fix for Ubuntu 26 that will allow logins using the DOMAINusername format?
4 Answers
Check the SSH and SSSD logs first, especially the authentication log and the SSSD domain log. They should show whether the failure happens because the account is rejected by `simple_allow_groups`, because the DOMAINusername form is being normalized, or because the newer SSH stack is rejecting the transformed username.
Try explicitly setting the login name in the SSH command, for example `ssh -l username@domain servername`. NetBIOS itself is generally best avoided, but this may help distinguish the account format issue from the underlying authentication problem.
Ubuntu 26 may be using a newer OpenSSH version with stricter username handling. If the Windows client sends `DOMAINuser` but SSSD normalizes that to `user`, sshd may see a mismatch and reject the authentication even though the account is valid. The fix is to make the username format consistent between the Windows client, sshd, and SSSD, or install an OpenSSH/SSSD update that addresses the normalization behavior.
You can hide the username formatting requirement with an SSH client configuration. In the user’s `~/.ssh/config`, add a host rule and specify the login name you want SSH to use, for example:
`Host *.your.domain`
` User username@domain`
That way users can connect using only the server name, assuming the host pattern matches.
The issue isn’t about enabling NetBIOS services. I’m referring to the SAM-style account name that the Windows OpenSSH client automatically sends, such as DOMAINname.surname.