Hello,
I have trouble obtaining a kerberos ticket when loggin with sssd.
in /var/log/sssd/krb5_child.log i get the line : [[sssd[krb5_child[9521]]]] [unpack_buffer] (0x0100): cmd [241] uid [10007] gid [10000] validate [false] enterprise principal [true] offline [false] UPN [USER@MYDOMAIN]
My problem is i need to restart the service to switch this to "offline [false]".
(Note that authentication works otherwise, it's just the kerberos ticket that is missing).
Maybe I missed an option to set the update rate ?
Thanks, Marc
On Fri, Jan 15, 2021 at 01:45:33PM +0100, mbalembo wrote:
Hello,
I have trouble obtaining a kerberos ticket when loggin with sssd.
in /var/log/sssd/krb5_child.log i get the line : [[sssd[krb5_child[9521]]]] [unpack_buffer] (0x0100): cmd [241] uid [10007] gid [10000] validate [false] enterprise principal [true] offline [false] UPN [USER@MYDOMAIN]
My problem is i need to restart the service to switch this to "offline [false]".
(Note that authentication works otherwise, it's just the kerberos ticket that is missing).
Maybe I missed an option to set the update rate ?
Hi,
you should check in the domain log sssd_your.domain.name.log why SSSD switched into offline mode. It might be an error while connecting to a LDAP server or hitting some timeouts during authentication or other reasons.
In offline mode SSSD uses a cached password has from the last successful online authentication to authenticate the user. That explains why authentication works but you do not have a Kerberos ticket, which can only be requested when online.
HTH
bye, Sumit
Thanks, Marc _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Hello,
SSSD goes offline because network is not fully up when the service start (DNS fail on LDAP server). If I wait for the network before starting the service, it works fine.
My understanding was that SSSD would try to go back online on it's own (whether at a regular interval or when someone try to authenticate ?).
If this is not the case i'll trigger a SSSD restart when network goes up/change.
Thanks for the help, Marc
On Tue, Feb 16, 2021 at 5:42 PM mbalembo marc.balemboy@csgroup.eu wrote:
Hello,
SSSD goes offline because network is not fully up when the service start (DNS fail on LDAP server). If I wait for the network before starting the service, it works fine.
My understanding was that SSSD would try to go back online on it's own
Yes, it should (see man sssd.conf 'offline_timeout') It also should monitor and process changes in networks (see man sssd.conf 'disable_netlink'), so starting sssd before the network is up shouldn't be an issue. What package version do you use?
(whether at a regular interval or when someone try to authenticate ?).
If this is not the case i'll trigger a SSSD restart when network goes up/change.
Thanks for the help, Marc
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
sssd-users@lists.fedorahosted.org
-
Alexey Tikhonov -
mbalembo -
Sumit Bose