On Mon, 2012-04-16 at 09:19 -0400, Dmitri Pal wrote:
On 04/16/2012 01:29 AM, Braden McDaniel wrote:
> On Sun, 2012-04-15 at 15:37 -0400, Braden McDaniel wrote:
>
>> I've had more or less the same experience upon a fresh install of the
>> Fedora 17 prerelease on a different machine.
> This one's working fine, now; I had forgotten to add a host principal
> for the machine.
>
> The Fedora 16 box is still a problem, though.
>
There might be some SSSD related misconfiguration. Without SSSD config
and logs produced with high debug level it is hard to advise anything.
The /etc/sssd/sssd.conf files on the Fedora 17 box (where things are
working fine) and the Fedora 16 box (where things are not) are, aside
from the ordering of settings, identical. Here is the sssd.conf from
the Fedora 16 box:
# cat /etc/sssd/sssd.conf
[domain/default]
cache_credentials = True
auth_provider = krb5
chpass_provider = krb5
ldap_id_use_start_tls = False
ldap_search_base = dc=endoframe,dc=net
id_provider = ldap
ldap_uri =
ldap://ldap.endoframe.net
ldap_tls_cacertdir = /etc/openldap/cacerts
krb5_realm =
ENDOFRAME.NET
krb5_server =
kerberos.endoframe.net
krb5_kpasswd =
kerberos.endoframe.net
[sssd]
services = nss, pam
config_file_version = 2
domains = default
[nss]
[pam]
[sudo]
[autofs]
[ssh]
When I log into the Fedora 16 box with gdm and open a terminal, I get
this:
$ klist
klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_1000)
If I do the same on the Fedora 17 box, I get this:
$ klist
Ticket cache: FILE:/tmp/krb5cc_1000_N61gp4
Default principal: braden(a)ENDOFRAME.NET
Valid starting Expires Service principal
04/16/12 18:57:05 04/17/12 18:57:05 krbtgt/ENDOFRAME.NET(a)ENDOFRAME.NET
renew until 04/16/12 18:57:05
Is it the case that local authentication, if available, is simply
preferred to Kerberos? There exists a local user account for "braden"
on the Fedora 16 box, but not the Fedora 17 one.
If this is still mysterious, I'll see about getting logs.
--
Braden McDaniel <braden(a)endoframe.com>