All,

Never mind; I found it myself.  (compared it to a good deployment).  I was not passing in ldap_sasl_authid to each child domain.  So the default (if you don't set) is "host/HOSTNAME@REALM".  That default works -- for the local child domain.

Example:
   host/AUSTGCORE25@AMER.EXAMPLE.COM 
 
However, that default does not work for the remote child domain.  Example:

    host/AUSTGCORE25@APAC.EXAMPLE.COM  

Still -- this error message is cryptic!  host/AUSTGCORE25@AMER.EXAMPLE.COM  is the one auth_sasl_authid that can be found (by the local AMER.EXAMPLE.COM child domain).  It's in the /etc/krb5.keytab file. It's the other auth_sasl_authid's that the other respective child domains can't find:

   host/AUSTGCORE25@APAC.EXAMPLE.COM  
   host/AUSTGCORE25@EMEA.EXAMPLE.COM  
   etc.

Anyway, all good now.

Spike



On Mon, Jul 8, 2019 at 12:10 PM Spike White <spikewhitetx@gmail.com> wrote:
sssd experts,

We have a “nuisance-level” problem with RHEL8 physical builds after AD-integrating via sssd.  How do I stop certain annoying messages in /var/log/messages?

This RHEL8 physical build properly creates an /etc/krb5.keytab file with the expected host entries.  Here’s the snippet from kutil:

 

[root@austgcore25 log]# cd /etc

[root@austgcore25 etc]# ktutil

ktutil:  read_kt /etc/krb5.keytab

ktutil:  list -t -e -k

slot KVNO Timestamp         Principal

---- ---- ----------------- ---------------------------------------------------

   6   16 07/03/2019 21:31            host/AUSTGCORE25@AMER.EXAMPLE.COM (des-cbc-crc)  (0xbf3d37462967e65e)

   7   16 07/03/2019 21:31            host/AUSTGCORE25@AMER.EXAMPLE.COM (des-cbc-md5)  (0xbf3d37462967e65e)

   8   16 07/03/2019 21:31            host/AUSTGCORE25@AMER.EXAMPLE.COM (arcfour-hmac)  (0xa21feefac524db9e82f3e38e73551c28)

   9   16 07/03/2019 21:31            host/AUSTGCORE25@AMER.EXAMPLE.COM (aes128-cts-hmac-sha1-96)  (0x196ff6a33ef6284bb432f97cf36e737c)

  10   16 07/03/2019 21:31            host/AUSTGCORE25@AMER.EXAMPLE.COM (aes256-cts-hmac-sha1-96)  (0xadd866228352701a94f5cd40d76ed886a7fe084b2f7a90981b16d19f14962e3b)

 

The AD integration seems to work fine.  I can log in with my AD account no problem.  Even after reboots.  (cross domain authentication temporarily not working on this build, likely unrelated.)

 

However, we continue to get the complaints in /var/log/messages:

 

Jul  8 11:38:25 austgcore25 [sssd[ldap_child[1816]]][1816]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/AUSTGCORE25@AMER.EXAMPLE.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection.

Jul  8 11:38:26 austgcore25 [sssd[ldap_child[1817]]][1817]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/AUSTGCORE25@AMER.EXAMPLE.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection.

 

I notice it’s attempting to use MEMORY:/etc/krb5.keytab.    

How do I stop this annoying messages in /var/log/messages? We have multiple AD domains defined in our sssd.conf file for this cross-domain auth.  (Usually, cross-domain auth works fine for us.)

 

Spike