https://bugzilla.redhat.com/show_bug.cgi?id=2375570
Bug ID: 2375570
Summary: Sssd 2.11.x doesn't use Kerberos cached auth:
get_password_for_cache_auth: Unsupported auth token
type [17]
Product: Fedora
Version: 42
Hardware: x86_64
OS: Linux
Status: NEW
Component: sssd
Keywords: Regression
Severity: high
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: ksuszyns(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
After upgrading Fedora 42, the sssd has been upgraded to 2.11.0-1.fc42 and with
that, the caching of the auth broke. Without a connection to the Kerberos
server, the user can't authenticate/log in to the machine.
Downgrading to 2.10.2-3.fc42 solves the issue.
Lots of logs (hundreds of megabytes) like the following (from
/var/log/sssd/sssd_ipa.redhat.com.log):
(2025-06-23 19:06:39): [be[ipa.redhat.com]] [sbus_issue_request_done] (0x0040):
sssd.dataprovider.getAccountInfo: Error [1432158212]: SSSD is offline
and also from /var/log/sssd/sssd_nss.log:
(2025-06-23 19:06:39): [nss] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#7] CR #769: Could not get account info [1432158212]: SSSD is offline
While authentication without VPN I also see (in /var/log/sssd/sssd_pam.log):
(2025-06-23 19:05:52): [pam] [get_password_for_cache_auth] (0x0010): [CID#3]
Unsupported auth token type [17].
* ... skipping repetitive backtrace ...
(2025-06-23 19:05:52): [pam] [get_password_for_cache_auth] (0x0010): [CID#3]
Failed to get password.
* ... skipping repetitive backtrace ...
(2025-06-23 19:05:52): [pam] [pam_reply] (0x0010): [CID#3]
get_password_and_type_for_cache_auth failed.
* ... skipping repetitive backtrace ...
(2025-06-23 19:05:52): [pam] [client_send] (0x0010): [CID#3] Failed to send
data, aborting client!
Reproducible: Always
Steps to Reproduce:
1. Have a Kerberos auth setup and working both with connection and without it,
running on sssd < 2.11.0
2. Upgrade to 2.11.x
Actual Results:
Without the network connection, the auth does not work
Expected Results:
The auth should work regardless of the network connection. Credentials should
be cached.
Additional Information:
Possible upstream issue: https://github.com/SSSD/sssd/issues/7968
More info:
https://redhat-internal.slack.com/archives/C05AWLALLP6/p1749486720894889
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2375570
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2351336
Bug ID: 2351336
Summary: /etc/krb5.conf.d/enable_sssd_conf_dir is mistakenly in
package sssd-krb5, not in sssd-krb5-common
Product: Fedora
Version: 41
Hardware: x86_64
OS: Linux
Status: NEW
Component: sssd
Severity: medium
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: hey(a)runiq.de
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
I have used realmd to join a host to an Active Directory domain. Realmd uses
sssd-ad for this, which pulls in sssd-krb5-common but _not_ sssd-krb5.
Unfortunately, sssd-krb5-common does not install the snippet
/etc/krb5.conf.d/enable_sssd_conf_dir. This results in SSH refusing
gssapi-with-mic authentication.
When I additionally install the sssd-krb5 package (which includes the snippet),
or create the snippet manually, SSH logins use my SSSD config and GSSAPI
authentication goes through.
Reproducible: Always
Steps to Reproduce:
1. Install realmd on a host
2. Join host to Active Directory domain
3. Enable SSH daemon
4. ssh -l user@realm -o preferredauthentications=gssapi-with-mic host
Actual Results:
Authentication is denied, no SSH session opened
Expected Results:
Authentication goes through, SSH session is opened
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2351336
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2325893
Bug ID: 2325893
Summary: sssd gpo_child doesn't have sufficient rights to
populate GPO policies
Product: Fedora
Version: 41
Hardware: x86_64
OS: Linux
Status: NEW
Component: sssd
Keywords: CommonBugs, Desktop
Severity: medium
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: nekopilot(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, mzidek(a)redhat.com,
pbrezina(a)redhat.com, sbose(a)redhat.com,
ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
# 1. Issue
After upgrade from F39 to F41 via UI path the login to the system with AD
account is not possible. Local account works well.
# 2. Workaround
sssd service works under sssd user in Fedora 41. The folder with GPO policies
has wrong rights with owner root:
ls -lah /var/lib/sss/gpo_cache/example.com/Policies/
total 0
drwx------. 4 root root 98 Jan 10 2024 .
drwx------. 3 sssd sssd 22 Jan 10 2024 ..
drwx------. 3 root root 36 Nov 13 07:33 {31B2F332-016D-11D2-945F-00C04FBB84F9}
drwx------. 3 root root 36 Nov 13 07:33 {7E50761D-1E4D-4D2B-BD86-E667EED3DF1E}
It is possible to change the owner of the directories. After that the login
with AD account works well.
chown -R sssd:sssd /var/lib/sss/gpo_cache
Reproducible: Always
Steps to Reproduce:
1. Your F39 system must be joined to AD with sssd and you can login to the
system with AD account.
2. Upgrade from F39 to F41.
3. Try to login with AD account.
Actual Results:
Login from Gnome UI is not possible with error: "Wrong user name or password".
Expected Results:
You can login to the system with AD account.
Your F39 system must be joined to AD with sssd and you can login to the system
with AD account.
After upgrade you can't login from UI with AD account but:
1. kinit user.name(a)example.com - works well.
1. id user.name(a)example.com - works well.
1. realm list - looks good.
In logs you can find error message:
cat /var/log/sssd/gpo_child.log
```
[gpo_child[4066]] [prepare_gpo_cache] (0x0020): [RID#23]
mkdir(/var/lib/sss/gpo_cache/example.com/Policies/{31B2F332-016D-11D2-945F-…
failed: 13
```
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2325893
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2373979
Bug ID: 2373979
Summary: python3-sssdconfig packs outdated .pyc files
Product: Fedora
Version: rawhide
Status: NEW
Component: sssd
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: adelton(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Reoccurence of bug #2319608:
The /usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/*.cpython-314.pyc
/usr/lib/files get regenerated when SSSDConfig module is used.
Reproducible: Always
Steps to Reproduce:
1. dnf install -y python3-sssdconfig
2. stat
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
3. python3 -c 'import SSSDConfig'
4. stat
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
Actual Results:
bash-5.2# stat
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
File:
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
Size: 59904 Blocks: 120 IO Block: 4096 regular file
Device: 0,142 Inode: 1085021 Links: 2
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2025-06-06 00:00:00.000000000 +0000
Modify: 2025-06-06 00:00:00.000000000 +0000
Change: 2025-06-20 05:52:59.146656555 +0000
Birth: 2025-06-20 05:52:59.146512950 +0000
bash-5.2# python3 -c 'import SSSDConfig'
bash-5.2# stat
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
File:
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
Size: 61398 Blocks: 120 IO Block: 4096 regular file
Device: 0,142 Inode: 1081628 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2025-06-20 05:53:34.790753836 +0000
Modify: 2025-06-20 05:53:34.792024966 +0000
Change: 2025-06-20 05:53:34.792024966 +0000
Birth: 2025-06-20 05:53:34.790753836 +0000
Expected Results:
The Size and Modify time in the second stat run should match the output from
the first one.
First found by
https://github.com/freeipa/freeipa-container/actions/runs/15771389975.
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2373979
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2388766
Bug ID: 2388766
Summary: sssd-idp package is missing libsss_idp.so
Product: Fedora
Version: 42
OS: Linux
Status: NEW
Component: sssd
Severity: medium
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: trevor(a)lr90.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Description of problem:
sssd fails to start the idp module due to a missing libsss_idp.so library
[dp_module_open_lib] (0x1000): Loading module [idp] with path
[/usr/lib64/sssd/libsss_idp.so]
[dp_module_open_lib] (0x0010): Unable to load module [idp] with path
[/usr/lib64/sssd/libsss_idp.so]: /usr/lib64/sssd/libsss_idp.so: cannot open
shared object file: No such file or directory
[dp_load_module] (0x0020): Unable to create DP module.
[dp_target_init] (0x0010): Unable to load module idp
Version-Release number of selected component (if applicable):
2.11.1-1.fc42
How reproducible:
install sssd-idp, configure sssd.conf to include a domain with "id_provider =
idp" and then attempt to start the sssd service. The above was captured with
"debug_level = 9"
Inspecting the rpm does not list the required library.
bash-5.2# rpm -ql sssd-idp
/etc/krb5.conf.d/sssd_enable_idp
/usr/lib/.build-id
/usr/lib/.build-id/0b/747161a609b78de1a1470a76975794572f5bab
/usr/lib/.build-id/bb/a6be68aab1336de346ac8d41d083b59d25f42a
/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so
/usr/libexec/sssd/oidc_child
/usr/share/sssd/krb5-snippets/sssd_enable_idp
Steps to Reproduce:
1. dnf install sssd-idp
2. create /etc/sssd.conf per above
3. syetemctl start sssd
Actual results:
sssd fails to start
Expected results:
sssd starts
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2388766
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2375213
Bug ID: 2375213
Summary: Transition of log file ownership to sssd user/group
does not fix logrotated files, which breaks logrotate
Product: Fedora
Version: 42
OS: Linux
Status: NEW
Component: sssd
Severity: medium
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: jbilling(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
When the sssd-common package introduced a change to the permissions of the log
files in /var/log/sssd/, this was added to the RPM %postinstall scriptlet:
/usr/bin/chown -f sssd:sssd /var/log/sssd/*.log || true
(Ref: https://src.fedoraproject.org/rpms/sssd/blob/f42/f/sssd.spec#_1119 )
However, there is also a logrotate configuration in sssd-common that rotates
and compresses the log files /var/log/sssd/*.log, and it also has "su sssd
sssd" in the configuration. (Ref:
https://github.com/SSSD/sssd/blob/master/src/examples/logrotate.in)
If sssd had been running before the transition to using sssd user/groups for
log file ownership, there were several root:root owned files that had been
rotated earlier. However, logrotate can no longer rotate them because their
permissions were restricted to root and logrotate is running as sssd:sssd.
You'll get an error that looks like:
logrotate[61244]: error: unable to open /var/log/sssd/sssd_pam.log-20250511
(read-only) for compression: Permission denied
This causes the logrotate.service to error out immediately, rather than
continuing to rotate log files.
I think the glob in the rpm %post install scriptlet should be changed to
/var/log/sssd/*.log* to address this.
Reproducible: Always
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2375213
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…