On Thu, 1 Mar 2012, Ondrej Valousek wrote:
Got it finally working by re-creating /etc/krb5.keytab file from the scratch.
It turned out, that I did not use Samba to join the machine to AD, but I used Centrify.
There is nothing wrong with that, the only thing is, that unlike Samba &
SSSD, Centrify does refresh principals in /etc/krb5.keytab creating multiple
principals in keytab that differ only by the KVNO number.
This is nice, but both sshd & pam_krb5.so seem to totally ignore KVNOs,
picking the first principal they find in keytab.
Why would you want to collect the old credentials? Aren't the credentials
with the lower KVNOs obsolete?
FYI: https://fedorahosted.org/sssd/ticket/1041 is tracking this (scheduled for SSSD 1.11 in 9 months).