Am Wed, Feb 08, 2023 at 12:45:57AM -0000 schrieb r0 nam1 via FreeIPA-users:
Realized I never set up any mapping rules, fixed that and they match
properly.
Looking at the krb5_log now that's working, I see a few lines of interest:
[sss_krb5_prompter] (0x4000): sss_krb5_prompter name [(null)] banner [(null)] num_prompts
[1] EINVAL.
(2023-02-07 16:42:57): [krb5_child[699]] [sss_krb5_prompter] (0x4000): Prompt
[0][Password for user(a)INTERNAL.MY.DOMAIN].
(2023-02-07 16:42:57): [krb5_child[699]] [sss_krb5_prompter] (0x0200): Prompter interface
isn't used for password prompts by SSSD.
(2023-02-07 16:42:57): [krb5_child[699]] [sss_child_krb5_trace_cb] (0x4000): [699]
1675816977.033417: Preauth module encrypted_challenge (138) (real) returned:
-1765328254/Cannot read password
Here's that log:
https://pastebin.com/U7At3nkX
Hi,
looks like still the password if used for authentication. Please send
all files from /var/log/sssd to get a better understanding why SSSD does
not want to use the certificate from the Smartcard for authentication.
bye,
Sumit
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue