Hi Rob,

I finally caught issue (1).
User tried to login via ssh, and the server "could find his publicKey".
After clearing cache and restarting sssd, user was able to login.

Logs are attached.


On Thu, Jun 13, 2019 at 7:40 PM Rob Crittenden <rcritten@redhat.com> wrote:
Jo Domsic via FreeIPA-users wrote:
> Hi freeipa-users!
>
> My IPA users occasionally report these issues:
> 1. Unable to login (failed pub key) via ssh on linux server
> 2. Missing shell (defaulted to sh, instead of bash or zsh) after ssh login on linux server
> 3. Missing home directory after ssh login on linux server
>
> All of the users are present in ActiveDirectory (domain=ad.lan), and attributes are set (sshPublicKey and loginShell).
> AD and FreeIPA are trusting each other. Linux servers are joined to domain (domain=ipa.lan).
>
> I can confirm (1) fails when I run: /usr/bin/sss_ssh_authorizedkeys user@ad.lan. It returns empty. Repeated runs return the same result - nothing.
> And both (2) and (3) happen without noticeable correlation to any other event.
> I can confirm it by running getent passwd user@ad.lan. It displays some fields (either home folder or shell) as empty.
>
> Issue (1) can be fixed with restarting sssd service and sss_cache -E.
> Issue (2) mostly fixes itself after X amount of time (sometimes a minute, something an hour).
> Issue (3) can be fixed same as (1), but sometimes also when repeating ssh connection (logout/login). 
> And as you might think: it's tiresome. :)
>
> Does it make sense to you? Which logs would be most useful to get the bottom of this?
>
> Note:
> AD servers 2016
> Freeipa version v4.6.4 (both servers and clients) on Centos 7.

Cranking up sssd debugging and reproducing is likely the first step.

rob