Hi all,

Thanks for your replies.

On Tue, Feb 7, 2017 at 7:55 AM, Sumit Bose <sbose@redhat.com> wrote:
On Tue, Feb 07, 2017 at 12:25:38PM +0100, Lukas Slebodnik wrote:
> On (06/02/17 20:25), Jakub Hrozek wrote:
> >On Sun, Feb 05, 2017 at 03:17:28AM -0000, michael@hurts.ca wrote:
> >> Hi,
> >>
> >> I'm in an environment with several AD sites, each with a DC. When remote sites' DCs are unreachable because of a VPN outage, I'm not able to complete password authentication with sudo.
> >>
> >> Does sssd_krb5_locator_plugin.so work with sssd-ad?
> >> Do I need to put anything in krb5.conf to activate it?
> >
> >No, should be automatic. Does the file the locator plugin writes
> >(/var/lib/sss/pubconf/kdcinfo.$REALM contain an address from the right
> >DC?

Yes, I see the local DC's IP address is being set in /var/lib/sss/pubconf/kdcinfo.$REALM.
 
> There is an implicit assumption that the directory /var/lib/sss/pubconf/
> is included in krb5.conf. Otherwise it would not work.
It is /var/lib/sss/pubconf/krb5.include.d/ which should be included in
/etc/krb5.conf.

Could anyone share a sample of what krb5.conf should look like, in order to include this directory? My krb5.conf looks default as heck. References to ATHENA.MIT.EDU all over the places.

I'm on Ubuntu 16.04 LTS, with sssd 1.13.4 and realmd 0.16.2. I used the realmd Puppet module from https://github.com/walkamongus/realmd to join the domain. It effectively does:

    echo $password | realm join $DOMAIN --unattended --user=JOIN_USER

... after creating a realmd.conf like:

    [mydomain]
    computer-ou = ...
    # My choice - I'm using myuser to log in, instead of myuser@domain
    fully-qualified-names = no
    managed-system = no
 
Jakub had asked:
    1) does this still happen if you try to pin the client to the
    correct site with ad_site?

-> Yes, it still happens. The site selected by sssd (dynamically or statically) appears to have no effect.

    2) are you sure the slowdown is because of Kerberos? iow, is kinit
    also slow? (because of the locator plugin, kinit should use the same
    server as sssd..)

-> Yes, kinit myuser@REALM is also slow. I can see it's looking up _kerberos-master._udp.REALM, and cycling through the DCs in that DNS record.

Thanks,
Mike