Windows domain users are prompted for the local users password by gnome

[dogfoobar]

Ubuntu Version

Ubuntu 26.04 LTS

Desktop Environment (if applicable)

GNOME

Problem Description

The ubuntu desktop is joined to a windows domain for domain logins and network drive access. It is headless and accessed via RDP. The RDP client is configured under settings → system → remote login. The domain users with access have sudo rights and can sudo in the terminal. All of this is working.

However after logging in the user is prompted by Gnome for the password of the local user created during setup not the currently logged in user. I’m not sure what this prompt is securing. This is also true when accessing settings or trying to shut the machine down or reboot. It will always prompt for the local user rather then the currently logged in domain users password. If the user does enter the local user password it still fails anyway with a message saying sorry that didn’t work. Whats going on here and how can it be adjusted to prompt for the domain users password. At least so they can shutdown / reboot.

[avb66]

@dogfoobar

I’m not sure what this prompt is securing.

Post a screenshot of this prompt.

[Actionparsnip]

Are you using SSSD for AD integration or something else?

[dogfoobar]

Its for the software updates reading helps . Anyway it seems gnomes sudo prompt is always promting localadmin rather then the logged in user that has sudo privileges. Stopping the prompts and being able to shut down the system would be enough. Software updates can be done from the terminal when needed.

[dogfoobar]

yup sssd

[sssd]
domains = XXXX.lan
config_file_version = 2
services = nss, pam

[domain/XXXX.lan]
default_shell = /bin/zsh
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = XXXX.LAN
realmd_tags = manages-system joined-with-adcli 
id_provider = ad
fallback_homedir = /home/%u@%d
ad_domain = XXXX.lan
use_fully_qualified_names = True
ldap_id_mapping = True
# access_provider = ad
access_provider = permit
simple_allow_users = jeff, bob

I’ve got pam-mount running as well to automount stuff.

[Actionparsnip]

Are you running xrdp as the server side service?

[Actionparsnip]

Try adding these options to your sssd.conf

ad_gpo_access_control = enforcing
ad_gpo_map_remote_interactive = +xrdp-sesman

[steelf]

Sorry for being brief, do not waste time on xrdp or SSSD

The issue is that GNOME Remote Desktop runs as a non-seat session (no seat0), so logind and PackageKit require admin auth for reboot and updates. And because Polkit checks the local sudo group instead of /etc/sudoers, it only knows localadmin.

Look into adding a custom rule in /etc/polkit-1/rules.d/ and adding your domain users to the local sudo group.

[avb66]

@dogfoobar

it seems gnomes sudo prompt is always promting localadmin rather then the logged in user that has sudo privileges

Because those prompts come from the polkit and polkit has nothing to do with sudo. The default polkit rules shipped by Ubuntu check for the active local session. You would need to adapt them to your environment. See as example /usr/share/polkit-1/rules.d/com.ubuntu.desktop.rules for inspiration. All available actions can be listed with pkaction --verbose.

[dogfoobar]

That’s a rabbit hole i’m not going to expend any more time on considering how much effort it was just to get to this point.

Is there another flavour of ubuntu or a linux distribution that would work better as a headless domain integrated pc? Or maybe an alternative way of configuring remote access.

No worries if not I can just slap windows back on it and it’ll do what i need to just fine.

[dogfoobar]

Tried this and as other replies predicted it didn’t do anything. But thanks for the suggestion

[steelf]

If you do not want to spend time reading Polkit manuals, here is a quick copy-paste fix-

Create /etc/polkit-1/rules.d/49-remote-admin.rules with this content:

polkit.addRule(function(action, subject) {
    if (action.id.indexOf("org.freedesktop.login1.power-off") === 0 ||
        action.id.indexOf("org.freedesktop.login1.reboot") === 0 ||
        action.id.indexOf("org.freedesktop.packagekit.") === 0) {
        return polkit.Result.YES;
    }
});

Save the file and restart polkit:

sudo systemctl restart polkit

This allows reboot, shutdown, and PackageKit actions from headless/RDP sessions without prompting for localadmin.

To stop GNOME from popping up update reminders altogether, run in terminal:

gsettings set org.gnome.software download-updates false

and stay with us

[dogfoobar]

Thanks that seems to have worked, thankyou very much for going out of your way to do that it’s appreciated

I’ve been using ubuntu on my personal desktop and on dev vm’s and servers for years and will definatly continue to do so. This was my first attempt at getting it running as a domain connected desktop pc. Its been an interesting experiment but the amount of effort involved and the results of that effort mean at this moment I wouldn’t do it again. I was hoping i could give some users a domain connected ubuntu laptop. However at this juncture a windows machine running an ubuntu vm is still the simplest option in that scenario. Thanks for all your help.

[steelf]

Glad to hear it worked for you!

As a quick tip for the future: if you ever decide to try domain-connected Ubuntu laptops again, take a look at “ADsys” -part of Ubuntu Pro, free for personal use/small fleets, along with “SSSD”.

Canonical built ADsys specifically to handle Active Directory GPOs, domain user privileges and Polkit rules automatically out of the box so you don’t have to fiddle with custom configuration files.

Good luck with your setup, and glad you are sticking with Ubuntu!