Ok, I don't know where to start, but let's see if I can explain this.
We use a product that uses certificates (a la smart cards) to log in
RHEL 8/9 on behalf of users.
Sumit has helped me in June but we didn't finish debugging this.
The bottom of the issue is that, when krb5-pkinit is present on the
system, the certificates do not work. When it isn't, it works.
On RHEL 8, for example, it works right away, after I configure sssd.conf
and install the CA certificates. But Sumit asked me if krb5-pkinit was
installed, and it wasn't. When I install it, it breaks the whole thing.
On RHEL 9, krb5-pkinit comes pre-installed. So the certificate-based
authentication doesn't work. I then remove the package. It then starts
Is there something I'm missing here? Should I somehow configure
krb5-pkinit in a way that I can get my certificate/smartcard
authentication to work with krb5-pkinit installed? Are there any
security issues to have that authentication working without the
Francis Augusto Medeiros-Logeay
I've got a double-barrelled problem.
We're an RHEL shop with mostly RHEL 7 machines authenticating via sssd
against LDAP which has, for a few weeks now, been undergoing very slow
logons. Now we are also seeing incomplete information being returned from
id -G. I've trimmed down a test case to eliminate every other variable I
can find, and I'm left with sssd as my focal point.
Any thoughts on where to start with this very puzzling, very annoying
Senior Linux/Middleware Administrator | Information Technology Services
+1-501-916-3010 | jxadams(a)ualr.edu | http://ualr.edu/itservices
*UA Little Rock*
Reminder: IT Services will never ask for your password over the phone or
in an email. Always be suspicious of requests for personal information that
come via email, even from known contacts. For more information or to
report suspicious email, visit IT Security
Trying to use cached creds with local users in the passwd file
authenticating via kerberos.
I have id_provider set to files and auth_provider set to krb5(AD DC).
Online authentication works fine however when I disconnect the network
authentication fails. The computer is not joined to a domain, I am only
leveraging the domain/realm for authentication purposes
offline_credentials_expiration = 7
Is this a supported configuration for offline logins with cached
# SSSD 2.9.2
The SSSD team is announcing the release of version 2.9.2 of the
System Security Services Daemon. The tarball can be downloaded from:
See the full release notes at:
RPM packages will be made available for Fedora shortly.
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
SSSD 2.9 branch is now in long-term maintenance (LTM) phase.
### General information
* `libkrb5-1.21` can now be used to build PAC plugin.
* `sssctl cert-show` and `cert-show cert-eval-rule` can now be run as
### Important fixes
* SSSD does no longer crash if PIN is introduced but the tactile trigger
isn't pressed during passkey authentication.
* SSSD can now recover if memory-cache files under `/var/lib/sss/mc`
where truncated while SSSD is running.
* Chaining of identical D-Bus requests that run in parallel to avoid
multiple backend queries works again.
### Configuration changes
* New option `local_auth_policy` is added to control which offline
authentication methods will be enabled by SSSD. This option is relevant
for authentication methods which have online, and offline capability
such as passkey, and smartcard authentication. The default value `match`
sets the offline methods to their corresponding online value. This
enables offline authentication when online kerberos pre-authentication
such as PKINIT, or passkey is supported by the backend, note that online
methods will still be attempted first. Option value `only` can be used
to disable online authentication entirely, or the value `enable:method`
to explicitly enable specific authentication methods, e.g. `enable:passkey`.
we want to setup several PCs in a way that they are accessible by
different (untrusted, i.e. not with root rights) people.
In principal, the requirements are:
- Each person gets an unique (UNIX) account that is managed at a server.
- Each person gets a home directory that is shared across all PCs,
comes from a central server. Ideally, the home directory is only
mounted when someone logs in and checks in the process the
authenticity of the user, the authenticity of the client and that of
- Ideally, one person is not able to access any data from the other
- The PCs should authenticate to the server. All communication should be
encrypted (at least all communication regarding authentication).
- I should hold that only a user with a valid account can login on a PC
with a valid key and mount data from a server with a valid key.
This seems to be a classical problem for LDAP, Kerberos, NFSv4 with sssd
as the client side daemon to manage all that.
However, I'm not quite sure, if I understood the interworkings
completely and if sssd is capable of working in the wanted way.
- We have an LDAP database which stores the users (of class
- We have set up a Kerberos daemon which uses this LDAP as database.
- We have set up an NFSv4 server that has an Kerberos principal and a
In my understanding the next steps now would be:
- Each user in the LDAP database also gets a Kerberos keytab (which can
be different from their login password).
- SSSD now has to do the following steps:
- When the user types in their password in the login manager, PAM in
connection with sssd use this to bind to the LDAP server (so sssd
uses LDAP as id_provider and LDAP as auth_provider).
- After the successful authentication, sssd gets the Kerberos key from
the Kerberos database and uses that key to securely mount the NFSv4
home directory on the PC (the target folder is also specific as part
of the user attributes, but where can sssd find the folder on the host?).
Is that possible? I also read that Kerberos in connection with NFSv4 can
be used to authenticate the NFSv4 server, the NFSv4 client _and_ the
specific user. Can that happen all simultaneously, so in one mount
command? I only find the `sec=krb5x` mount options where the NFSv4
client and the NFSv4 server authenticates to the Kerberos server but
without using anything from the user.