From 30b97a39f75d676f25fe8cdaf03c41e2b7a97e41 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Thu, 15 Dec 2016 11:30:13 +0100
Subject: [PATCH 1/2] KRB5: Advise the user to inspect the krb5_child.log if
 the child fails with a System Error

It's often not clear to admins where to look further if the krb5_child
fails with a generic error. This patch just adds a DEBUG message
advising the admin to look into the krb5_child.log for more information.

Related:
    https://fedorahosted.org/sssd/ticket/2955
---
 src/providers/krb5/krb5_auth.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index a5ecb24..5c74be3 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -1023,6 +1023,9 @@ static void krb5_auth_done(struct tevent_req *subreq)
         goto done;
 
     default:
+        DEBUG(SSSDBG_IMPORTANT_INFO,
+              "The krb5_child process returned an error. Please inspect the "
+              "krb5_child.log file for more information\n");
         state->pam_status = PAM_SYSTEM_ERR;
         state->dp_err = DP_ERR_OK;
         ret = EOK;

From 45b5ec06d3f45a47c9093e4b1f7e3be2ba17692a Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Thu, 15 Dec 2016 11:30:41 +0100
Subject: [PATCH 2/2] KRB5: Add some debugging tips for the 'Server not
 found..' error during validation

Adds some tips for the admin on how to debug the 'Server not found in
Kerberos database' kind of errors returned during validation.

Related:
    https://fedorahosted.org/sssd/ticket/2955
---
 src/providers/krb5/krb5_child.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index be31ddb..8420553 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -1177,6 +1177,15 @@ static krb5_error_code validate_tgt(struct krb5_req *kr)
     } else {
         DEBUG(SSSDBG_CRIT_FAILURE ,"TGT failed verification using key " \
                                     "for [%s].\n", principal);
+        if (kerr == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN) {
+            DEBUG(SSSDBG_IMPORTANT_INFO,
+                  "The server principal was not found. If the user comes "
+                  "from a different domain than the host, please verify "
+                  "that Kerberos servers from all domains in the trust "
+                  "paths are reachable. Acquiring a ticket using the 'kvno' "
+                  "utility for the principal used for verification might "
+                  "also be used to debug the issue further\n");
+        }
         goto done;
     }
 
