On (13/12/16 00:52), TomK wrote:
On 12/13/2016 12:27 AM, TomK wrote:
> Tossing this here as well as I'm already chatting on the FreeIPA mailing
> list about this but figured I'd post here as well.
>
> Is this considered a bug?
>
> (Sun Dec 11 03:26:13 2016) [sssd[pam]] [pam_dp_process_reply] (0x0200):
> received: [4 (System error)][mds.xyz]
> (Sun Dec 11 03:26:13 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply
> called with result [4]: System error.
>
> Config is basic in what comes from the FreeIPA configuration:
>
> [root@idmipa01 sssd]# cat /etc/sssd/sssd.conf
> [domain/nix.mds.xyz]
> debug_level = 9
>
> cache_credentials = True
> krb5_store_password_if_offline = True
> ipa_domain = nix.mds.xyz
> id_provider = ipa
> auth_provider = ipa
> access_provider = ipa
> ipa_hostname = idmipa01.nix.mds.xyz
> chpass_provider = ipa
> ipa_server = idmipa01.nix.mds.xyz
> ipa_server_mode = True
> ldap_tls_cacert = /etc/ipa/ca.crt
>
> [sssd]
> debug_level = 9
> services = nss, sudo, pam, ssh
> config_file_version = 2
> domains = nix.mds.xyz
>
> [nss]
> debug_level = 9
> memcache_timeout = 600
> homedir_substring = /home
>
> [pam]
> debug_level = 9
>
> [sudo]
>
> [autofs]
>
> [ssh]
>
> [pac]
> debug_level = 9
>
> [ifp]
>
> [root@idmipa01 sssd]# cat /etc/krb5.conf
> includedir /var/lib/sss/pubconf/krb5.include.d/
>
> [logging]
> default = FILE:/var/log/krb5libs.log
> kdc = FILE:/var/log/krb5kdc.log
> admin_server = FILE:/var/log/kadmind.log
>
> [libdefaults]
> default_realm = NIX.MDS.XYZ
> # dns_lookup_realm = false
> dns_lookup_realm = true
> dns_lookup_kdc = true
> rdns = false
> ticket_lifetime = 24h
> forwardable = yes
> udp_preference_limit = 0
> default_ccache_name = KEYRING:persistent:%{uid}
>
> [realms]
> NIX.MDS.XYZ = {
> kdc = idmipa01.nix.mds.xyz:88
> master_kdc = idmipa01.nix.mds.xyz:88
> admin_server = idmipa01.nix.mds.xyz:749
> default_domain = nix.mds.xyz
> pkinit_anchors = FILE:/etc/ipa/ca.crt
>
> auth_to_local = RULE:[1:$1@$0](^.*@MDS.XYZ$)s/@MDS.XYZ/@mds.xyz/
> auth_to_local = DEFAULT
> }
>
> [domain_realm]
> .nix.mds.xyz = NIX.MDS.XYZ
> nix.mds.xyz = NIX.MDS.XYZ
>
> [dbmodules]
> NIX.MDS.XYZ = {
> db_library = ipadb.so
> }
>
> [root@idmipa01 sssd]#
>
>
Ok, upgraded to sssd 1.14. Now the message reads:
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [merge_msg_ts_attrs] (0x2000): No such
DN in the timestamp cache: name=tom(a)mds.xyz,cn=users,cn=mds.xyz,cn=sysdb
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [sysdb_merge_res_ts_attrs] (0x2000):
TS cache doesn't contain this DN, skipping
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_check_user_search] (0x0400):
Returning info for user [tom@mds.xyz(a)mds.xyz]
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pd_set_primary_name] (0x0400): User's
primary name is tom(a)mds.xyz
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_initgr_cache_set] (0x2000):
[MDS.XYZ\tom] added to PAM initgroup cache
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending
request with the following data:
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_print_data] (0x0100): command:
SSS_PAM_AUTHENTICATE
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_print_data] (0x0100): domain:
mds.xyz
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_print_data] (0x0100): user:
tom(a)mds.xyz
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_print_data] (0x0100): service:
sshd
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: not
set
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost:
192.168.0.208
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok
type: 1
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok
type: 0
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 1
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid:
12455
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_print_data] (0x0100): logon name:
MDS.XYZ\tom
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [sbus_add_timeout] (0x2000):
0x7f4deb3736c0
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_dom_forwarder] (0x0100):
pam_dp_send_req returned 0
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [sss_dp_req_destructor] (0x0400):
Deleting request: [0x7f4deab76c60:3:tom@mds.xyz@mds.xyz]
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [sbus_remove_timeout] (0x2000):
0x7f4deb3736c0
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn:
0x7f4deb36cf90
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching.
(Tue Dec 13 00:49:24 2016) [sssd[pam]] [pam_dp_process_reply] (0x0200):
received: [6 (Permission denied)][mds.xyz]
I think this message is crystal clear.
I would recommend to look into domain log (and also probably krb5_child)
@see also our wiki
https://fedorahosted.org/sssd/wiki/Troubleshooting#TroubleshootingAuthent...
LS