OK, then no wonder sssd can’t see load the attributes. Are the attributes present in the
user entry? If you call ipa user-show you should see them.
If the attributes are there, but are not saved, then the sssd domain logs might have an
idea what went wrong.
On 9 Aug 2018, at 10:44, Peter Viskup <skupko.sk(a)gmail.com>
wrote:
No the pubkey attribute is not there. Tried to clean/invalidate the
cache, but didn't help.
This is the complete cache entry:
dn: name=ipauser@domain,cn=users,cn=domain,cn=sysdb
createTimestamp: 1517403271
fullName: Ipa User
gecos: Ipa User
gidNumber: 1462000031
homeDirectory: /home/ipauser
loginShell: /bin/bash
name: ipauser@domain
objectClass: user
uidNumber: 1462000031
originalDN: uid=ipauser,cn=users,cn=accounts,dc=domain,dc=com
userPrincipalName: ipauser@domain
mail: ipauser(a)domain.com
nameAlias: ipauser@domain
memberof: name=nou-jumpis-users@domain,cn=groups,cn=domain,cn=sysdb
memberof: name=ou-internal-security@domain,cn=groups,cn=domain,cn=sysdb
memberof: name=nou-internal-security-builders@domain,cn=groups,cn=domain,cn=sysdb
initgrExpireTimestamp: 1517403331
originalMemberOf:
cn=nou-internal-security-builders,cn=groups,cn=accounts,dc=domain,dc=com
originalMemberOf:
ipaUniqueID=e341f66a-e4c9-11e7-b40b-005056ab0ca4,cn=sudorules,cn=sudo,dc=domain,dc=com
originalMemberOf: cn=ou-internal-security,cn=groups,cn=accounts,dc=domain,dc=com
originalMemberOf:
ipaUniqueID=5acc123e-d5b5-11e7-9af8-005056ab0ca4,cn=hbac,dc=domain,dc=com
originalMemberOf: cn=nou-jumpis-users,cn=groups,cn=accounts,dc=domain,dc=com
originalMemberOf:
ipaUniqueID=dd273a22-d5b7-11e7-88bc-005056ab0ca4,cn=hbac,dc=domain,dc=com
originalMemberOf:
ipaUniqueID=4af6ee94-d5bd-11e7-9d4a-005056ab0ca4,cn=hbac,dc=domain,dc=com
originalMemberOf:
ipaUniqueID=3a9d728a-e4c6-11e7-88bc-005056ab0ca4,cn=sudorules,cn=sudo,dc=domain,dc=com
originalMemberOf:
ipaUniqueID=d03e4b9a-fc4d-11e7-a5c4-005056ab0ca4,cn=sudorules,cn=sudo,dc=domain,dc=com
originalMemberOf:
ipaUniqueID=43cb7646-1198-11e8-891e-005056ab0ca4,cn=hbac,dc=domain,dc=com
ccacheFile: FILE:/tmp/krb5cc_1462000031_Aqw31Q
krbLastPwdChange: 20180530070315Z
krbPasswordExpiration: 20180828070315Z
originalModifyTimestamp: 20180808100017Z
entryUSN: 252945251
lastUpdate: 1533722422
dataExpireTimestamp: 1533722482
distinguishedName: name=ipauser@domain,cn=users,cn=domain,cn=sysdb
# returned 1 records
# 1 entries
# 0 referrals
On Thu, Aug 9, 2018 at 9:18 AM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
> If you search the cache with ldbsearch -H /var/lib/sss/db/cache_domain.ldb does the
user have the pubkey attribute?
>
>> On 8 Aug 2018, at 11:02, Peter Viskup via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
>>
>> On Debian 9 client the sss_ssh_authorizedkeys command returns empty
>> list. But the ipauser has SSH key in its IPA profile setup via web UI.
>> Debug log does not point to any error:
>>
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [get_client_cred] (0x4000):
>> Client creds: euid[65534] egid[65534] pid[11834].
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [get_client_cred] (0x0080): The
>> following failure is expected to happen in case SELinux is disabled:
>> SELINUX_getpeercon failed [92][Protocol not available].
>> Please, consider enabling SELinux in your system.
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [setup_client_idle_timer]
>> (0x4000): Idle timer re-set for client [0x56353b9b65a0][18]
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [accept_fd_handler] (0x0400):
>> Client connected!
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_cmd_get_version] (0x0200):
>> Received client version [0].
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_cmd_get_version] (0x0200):
>> Offered version [0].
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ssh_cmd_parse_request]
>> (0x0400): Requested domain [DOMAIN]
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ssh_cmd_parse_request]
>> (0x0400): Parsing name [ipauser][DOMAIN]
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_parse_name_for_domains]
>> (0x0200): name 'ipauser' matched without domain, user is ipauser
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_parse_name_for_domains]
>> (0x0200): using default domain [DOMAIN]
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_ssh_cmd_get_user_pubkeys]
>> (0x0400): Requesting SSH user public keys for [ipauser] from [DOMAIN]
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_dp_issue_request]
>> (0x0400): Issuing request for [0x56353a7ea5f0:1:ipauser@DOMAIN@DOMAIN]
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_dp_get_account_msg]
>> (0x0400): Creating request for
>> [DOMAIN][0x1][BE_REQ_USER][name=ipauser@DOMAIN:-]
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sbus_add_timeout] (0x2000):
>> 0x56353b9b8fc0
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_dp_internal_get_send]
>> (0x0400): Entering request [0x56353a7ea5f0:1:ipauser@DOMAIN@DOMAIN]
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sbus_remove_timeout] (0x2000):
>> 0x56353b9b8fc0
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sbus_dispatch] (0x4000): dbus
>> conn: 0x56353b9af060
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sbus_dispatch] (0x4000): Dispatching.
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_dp_get_reply] (0x1000):
>> Got reply from Data Provider - DP error code: 0 errno: 0 error
>> message: Success
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ssh_user_pubkeys_search_next]
>> (0x0400): Requesting SSH user public keys for [ipauser@DOMAIN]
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Added timed
>> event "ltdb_callback": 0x56353b9bdcd0
>>
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Added timed
>> event "ltdb_timeout": 0x56353b9bdd90
>>
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Running timer
>> event 0x56353b9bdcd0 "ltdb_callback"
>>
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Destroying
>> timer event 0x56353b9bdd90 "ltdb_timeout"
>>
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Ending timer
>> event 0x56353b9bdcd0 "ltdb_callback"
>>
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Added timed
>> event "ltdb_callback": 0x56353b9b90e0
>>
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Added timed
>> event "ltdb_timeout": 0x56353b9b98e0
>>
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Running timer
>> event 0x56353b9b90e0 "ltdb_callback"
>>
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Destroying
>> timer event 0x56353b9b98e0 "ltdb_timeout"
>>
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [ldb] (0x4000): Ending timer
>> event 0x56353b9b90e0 "ltdb_callback"
>>
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [sss_dp_req_destructor]
>> (0x0400): Deleting request: [0x56353a7ea5f0:1:ipauser@DOMAIN@DOMAIN]
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [client_recv] (0x0200): Client
>> disconnected!
>> (Wed Aug 8 10:54:01 2018) [sssd[ssh]] [client_close_fn] (0x2000):
>> Terminated client [0x56353b9b65a0][18]
>>
>> What could be the root cause?
>>
>> --
>> Peter
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...
>