Apologies for the delay Sumit.
I've attached full sanitized logs this time. This should answer a few of the questions
you asked.
is there a line before '[-1750600185][Invalid UID in persistent
keyring
name]' error where krb5_child tries to switch to this UID or is it
always running as root?
I don't see a line involving a switch from that UID - the results when running ssh
user\@ad.domain.com(a)client as root vs. user(a)ad.domain.com seem to be the same.
> One of the (ldbsearch records returned) appears to be a user,
and the other, incorrect one, is a group record. Cleaning cache and deleting database
files does not seem to fix this.
Does the group record share some properties of the user record like same
name or GID==UID?
Yes it does, GID is the same.
Besides trying to figure out what is wrong with the KEYRING ccache
you
might also want to try if a different ccache type, e.g. FILE:....,
works any better?
I can switch this in the kerberos config on the client right, sure
D
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Tuesday, February 12, 2019 4:00 PM, Sumit Bose via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
> On Tue, Feb 12, 2019 at 08:37:44PM +0000, D wrote:
>
> > Sumit,
> > The ldbsearch on the ipa client revealed two records with the SID in question,
and the krb5 ccname is [KEYRING:persistent:$posix_uid_attribute] which matches the default
ccname format in krb5.conf.
>
> And is $posix_uid_attribute the same UID as the one from the log message
> two lines above:
>
> [unpack_buffer] (0x0100): cmd [...] uid [...] gid [...] validate ...
>
> Later on in the logs there should be
>
> [become_user] (0x0200): Trying to become user ...
> (0x2000): Running as ....
>
is there a line before '[-1750600185][Invalid UID in persistent
keyring
name]' error where krb5_child tries to switch to this UID or is it
always running as root?
>
> > One of them appears to be a user, and the other, incorrect one, is a group
record. Cleaning cache and deleting database files does not seem to fix this.
>
> Does the group record share some properties of the user record like same
> name or GID==UID?
>
> > The ldbsearch command on the ipa server returns only the user record.
> > Do you have any idea where this odd group record might be coming from?
>
> It would be best to have full logs to understand what is happening.
>
> But since you say that the group memberships of the user are looking
> correct I guess this is not the primary issue why the login failed.
Besides trying to figure out what is wrong with the KEYRING ccache
you
might also want to try if a different ccache type, e.g. FILE:....,
works any better?
>
> HTH
>
> bye,
> Sumit
>
> > Thank you for your hard work,
> > D
> > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> > On Tuesday, 12 February 2019 02:19, Sumit Bose via FreeIPA-users
freeipa-users(a)lists.fedorahosted.org wrote:
> >
> > > On Mon, Feb 11, 2019 at 03:51:07PM +0000, D via FreeIPA-users wrote:
> > >
> > > > Hello,
> > > > Would anyone mind helping me troubleshoot a problem?
> > > >
> > > > 1. Running a two-way trust between AD2016 and ipa-server
4.5.4-10.el7.
> > > > 2. Unable to log into an IPA client with an AD account via ssh. The
client has no trouble with “kinit $ad_user” and “getent passwd $ad_user”.
> > > > 3. The AD user appears to properly exist in the correct groups for
IPA/ad internal/external mapping as described in the docs.
> > > >
> > > > I think the problem occurs here, with the PAC fetch:
> > > > ==> /var/log/sssd/sssd_pac.log <==
> > > > (Mon Feb 11 05:24:36 2019) [sssd[pac]] [sysdb_search_object_attr]
(0x0020): Search with filter
[(&(|(objectCategory=user)(objectCategory=group))(objectSIDString= < MY SID HERE
>))] returned more than one object.
> > >
> > > SIDs should be unique and it looks that currently in SSSD's cache are
> > > more than one object with the given SID. You can check the results
> > > yourself by calling:
> > > ldbsearch -H /var/lib/sss/db/cache_DOMAIN.NAME.ldb
'(&(|(objectCategory=user)(objectCategory=group))(objectSIDString= < MY SID
HERE >))'
> > > (ldbsearch is in the ldb-tools package). Maybe this already explains
> > > what has happened but feel free to send the (sanitized) output.
> > >
> > > > (Mon Feb 11 05:24:36 2019) [sssd[pac]] [sysdb_search_object_attr]
(0x0040): Error: 22 (Invalid argument)
> > > > (Mon Feb 11 05:24:36 2019) [sssd[pac]] [cache_req_search_cache]
(0x0020): CR #5: Unable to lookup [<MY SID>(a)ad.domain.com] in cache [22]: Invalid
argument
> > > > ==> /var/log/sssd/krb5_child.log-20190210 <==
> > > > (Mon Feb 11 05:24:36 2019) [[sssd[krb5_child[26961]]]] [sss_send_pac]
(0x0040): sss_pac_make_request failed [-1][22].
> > > > (Mon Feb 11 05:24:36 2019) [[sssd[krb5_child[26961]]]] [validate_tgt]
(0x0040): sss_send_pac failed, group membership for user with principal [<my
username>(a)AD.DOMAIN.COM] might not be correct.
> > > > (Mon Feb 11 05:24:36 2019) [[sssd[krb5_child[26961]]]] [create_ccache]
(0x0020): 973: [-1750600185][Invalid UID in persistent keyring name]
> > > > (Mon Feb 11 05:24:36 2019) [[sssd[krb5_child[26961]]]]
[map_krb5_error] (0x0020): 1657: [-1750600185][Invalid UID in persistent keyring name]
> > >
> > > That's odd. At the start of the log messages for
'krb5_child[26961]'
> > > there should be a line like:
> > > [unpack_buffer] (0x0100): ccname: [KEYRING:persistent:.....
> > > Can you send the full line which the complete name of the ccache?
> > > bye,
> > > Sumit
> > >
> > > > ==> /var/log/sssd/sssd_ipa.domain.com.log <==
> > > > (Mon Feb 11 05:24:36 2019) [sssd[be[ipa.domain.com]]]
[child_sig_handler] (0x0100): child [26961] finished successfully.
> > > > (Mon Feb 11 05:24:36 2019) [sssd[be[ipa.domain.com]]] [krb5_auth_done]
(0x0040): The krb5_child process returned an error. Please inspect the krb5_child.log file
or the journal for more information
> > > > Addtl. Details:
> > > > ipa service-show ldap/prod-ipa01.ipa.domain.com(a)IPA.DOMAIN.COM| grep
PAC
> > > >
=========================================================================
> > > > PAC type: MS-PAC
> > > > Thanks,
> > > > D
> > >
> > > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > > To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
> > > > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> > > > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > >
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> > > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> > > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...