From 03a269380a52f53c1e89bf6b71e8dcef2fff90c4 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Thu, 15 Dec 2016 11:30:13 +0100
Subject: [PATCH 1/2] KRB5: Advise the user to inspect the krb5_child.log if
 the child fails with a System Error

It's often not clear to admins where to look further if the krb5_child
fails with a generic error. This patch just adds a DEBUG message
advising the admin to look into the krb5_child.log for more information.

Related:
    https://fedorahosted.org/sssd/ticket/2955
---
 src/providers/krb5/krb5_auth.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index a5ecb24..bdd8e24 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -1023,6 +1023,9 @@ static void krb5_auth_done(struct tevent_req *subreq)
         goto done;
 
     default:
+        DEBUG(SSSDBG_IMPORTANT_INFO,
+              "The krb5_child process returned an error. Please inspect the "
+              "krb5_child.log file or the journal for more information\n");
         state->pam_status = PAM_SYSTEM_ERR;
         state->dp_err = DP_ERR_OK;
         ret = EOK;

From b66f2372803039d390c9c5dede9b4488c79f238b Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Thu, 15 Dec 2016 11:30:41 +0100
Subject: [PATCH 2/2] KRB5: Add some debugging tips for the 'Server not
 found..' error during validation

Adds some tips for the admin on how to debug the 'Server not found in
Kerberos database' kind of errors returned during validation.

Related:
    https://fedorahosted.org/sssd/ticket/2955
---
 src/providers/krb5/krb5_child.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index be31ddb..8420553 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -1177,6 +1177,15 @@ static krb5_error_code validate_tgt(struct krb5_req *kr)
     } else {
         DEBUG(SSSDBG_CRIT_FAILURE ,"TGT failed verification using key " \
                                     "for [%s].\n", principal);
+        if (kerr == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN) {
+            DEBUG(SSSDBG_IMPORTANT_INFO,
+                  "The server principal was not found. If the user comes "
+                  "from a different domain than the host, please verify "
+                  "that Kerberos servers from all domains in the trust "
+                  "paths are reachable. Acquiring a ticket using the 'kvno' "
+                  "utility for the principal used for verification might "
+                  "also be used to debug the issue further\n");
+        }
         goto done;
     }
 
