centos6.3 authentikacio AD-be

Hello,

Valakinek mar sikerult a targyban emlitett dolgot megcsinalni? A szituacio az hogy kell egy centralizalt authencikacio wind2k8 AD-be ami kerberos-t hasznal.
Valahogy nem akar menni es nem tudom hogy tudnek tobb infot kinyerni hogy megoldjam.

Az sssd config:
[sssd]
services = nss, pam
config_file_version = 2
debug-level = 0xFFF0

domains = AD
[domain/AD]

ldap_uri = ldap://exampleDC.windows.domain.com/
ldap_id_use_start_tls = False
ldap_search_base = OU=Valami User,DC=windows,DC=domain,DC=com
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = test/test.windows.domain.com@WINDOWS.DOMAIN.COM
ldap_krb5_keytab = /etc/krb5.keytab # ez egy symlink /tmp/krb5cc_0, ez manualisan hoztam letre a kinit segitsegel
ldap_krb5_init_creds = true
#ldap_krb5_ticket_lifetime = 86400
krb5_realm = WINDOWS.DOMAIN.COM
krb5_server = exampleDC.windows.domain.com
krb5_kpasswd = exampleDC.windows.domain.com
krb5_canonicalize = False
enumerate = True
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
cache_credentials = True
#
# Plus config for AD
#
ldap_user_name = sAMAccountName
ldap_user_object_class = user
ldap_group_object_class = group
case_sensitive = False

debug-level = 0xFFF0

[nss]
# Exclude certain users from being fetched from the sss NSS database.
# This is particularly useful for system accounts.
filter_users = root, named, apache, dbus
filter_group = root
debug-level = 0xFFF0
[pam]
debug-level = 0xFFF0
[sudo]
debug-level = 0xFFF0
[autofs]

[ssh]

krb5.conf:
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = WINDOWS.DOMAIN.COM
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true

[realms]
WINDOWS.DOMAIN.COM = {
kdc = exampleDC.windows.domain.com
admin_server = exampleDC.windows.domain.com
}

[domain_realm]
windows.domain.com = WINDOWS.DOMAIN.COM
.windows.domain.com = WINDOWS.DOMAIN.COM

[appdefaults]
pam = {
debug = true
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}

es vegul a system-aut pam fajl:
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet_success
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so

account required pam_access.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so

password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so

session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_oddjob_mkhomedir.so skel=/etc/skel
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so

Sehogy sem akar menni az authentikacio, es igazat megvalva elakadtam. Az ldapsearch meg, mert ugye megvan a kerberos ticket, es azt hasznalva szepen tudom browsolni a fa azon reszeit amikre van jogom. De a login.....

Van vlakinek otlete?