On Tue, Nov 10, 2015 at 12:10:11PM +0100, Joschi Brauchle wrote:
Hello Lukas,
I will provide more logs shortly. Just one quick question:
I updates to Ubuntu 15.10 (latest) and all problems persist if I dont use
FILE based caches.
I then checked the installed packages in Ubuntu and to my surpise, I found a
mixed setup with MIT kerberos and Heimdal Kerberos libraries. E.g. the
openLDAP service and all Samba tools use heimdal, whereas the rest of the
system uses MIT kerberos libs.
That's expected.
Samba upstream only supports Heimdal at the moment. There is ongoing
work to support MIT as well, driven by Andreas Schneider, but it's not
finished yet.
At the same time, because Fedora only carries MIT and Fedora is more or
less our reference architecture for SSSD, then SSSD only[*] supports
Heimdal.
[*] There were some Heimdal patches in the past, but we accepted them
more or less blindly as long as they looked OK and didn't break MIT
builds. We never tested Heimdal ourselves.
So, I am starting to believe that the problems I see are coming from this
mixture of kerberos libs.
E.g., when I use DIR ccaches as default in /etc/krb5.conf and then remove
the KRB5CCNAME variable in my session, all MIT-based kerberos tools still
work (because they read the setup correctly from /etc/krb5.conf) while all
Samba tools fail and use /tmp/ to check for FILE caches.
Is there anything known about Ubuntu and anything else then FILE based
ccaches? E.g. I found:
https://www.mail-archive.com/sssd-users@lists.fedorahosted.org/msg03317.html
-Joschi
On 11/10/2015 11:40 AM, Lukas Slebodnik wrote:
>On (10/11/15 11:10), Joschi Brauchle wrote:
>>On 11/10/2015 10:54 AM, Lukas Slebodnik wrote:
>>>On (09/11/15 17:54), Joschi Brauchle wrote:
>>>>Please find the logs of the domain section here:
>>>>http://pastebin.com/raw.php?i=WjU2TFNT
>>>>
>>...
>>>The user ne96soh was successfully authenticated.
>>>Did you attach log fiels with kernel keyring ccache?
>>>
>>>LS
>>
>>Yes, the user is authenticated successfully!
>>The problem is, that there exists no CCACHE after login, i.e., I get:
>>----------
>>$ klist
>>klist: No credentials cache found while retrieving principal name
>>----------
>Could you tell us what is a value of env variable KRB5CCNAME
>after log-in?
>
>Do you test with ssh or su or "su -"
>
>Please also provide dump of sssd cache after authentication.
>There should be somethig about ccache as well.
>
>ldbsearch -H /var/lib/sss/db/cache_*.com.ldb
>
>e.g.
>ccacheFile: KEYRING:persistent:20728
>
>
>LS
>_______________________________________________
>sssd-users mailing list
>sssd-users(a)lists.fedorahosted.org
>https://lists.fedorahosted.org/mailman/listinfo/sssd-users
>
--
Dipl.-Ing. Joschi Brauchle, M.S.
Institute for Communications Engineering (LNT)
Technische Universitaet Muenchen (TUM)
80290 Munich, Germany
Tel: +49 89 289-23474
Fax: +49 89 289-23490
E-mail: joschi.brauchle(a)tum.de
Web:
http://www.lnt.ei.tum.de/
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users