[SSSD] sssd and kerberos.
Stephen Gallagher
sgallagh at redhat.com
Mon Aug 2 14:13:09 UTC 2010
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/02/2010 10:06 AM, Patrik Martinsson wrote:
> Hello,
>
> I've successfully setup'ed sssd on our systems to connect to our
> Microsoft AD with ldap
> authentication, now i want to use kerberos instead, and have I of course
> ran into some problems :)
>
> To start with, I'm not to familiar with kerberos so go easy on me here.
>
> I've successfully created a machineaccount in AD (with msktutil, also
> got it working with samba/net join)
> and obtained a kerberos keytab. A user can obtain a ticket by running
> 'kinit foouser', thereafter he/she
> can run for example 'ldapsearch -b 'ou=xx,dc=xx,dc=xx,dc=xx' -Omaxssf=0
> "(&(objectclass=user)(cn=xx))" uid'
> successfully.
>
> Here's to my question, (maybe this rather should be in a kerberos
> mailinglist, or maybe i should read a book however it's easiest to ask
> here :))
> Is the keytab used by sssd to authenticate to the kdc, is this even how
> it works ? Since the sssd is runned by root and root has no ticket,
> i figured it would work that way, but maybe I'm mistaken, maybe it's
> suppose to work in some other way ?
>
SSSD does not authenticate against a KDC. We can validate the TGT with a
host keytab, however (this proves that the response came from a real
KDC). This would be done by setting:
krb5_keytab = /etc/krb5.keytab
krb5_validate = True
That said, I think this is irrelevant to the issue at hand.
> Here's the krb5 part of the sssd.conf
> auth_provider = krb5
> krb5_kdcip = 123.123.123.123
> krb5_realm = foo
> krb5_changepw_principle = kadmin/changepw
> krb5_ccachedir = /tmp
> krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
> krb5_auth_timeout = 15
> krb5_keytab = /etc/krb5.keytab
>
> When i start sssd with -d10 i cant really see much messages about the
> kerberos authentication whether it fails or not,
Instead of starting with -d10, start with --debug-to-files and look in
/var/log/sssd. Kerberos authentication errors will appear in
/var/log/sssd/krb5_child.log and all other errors for this domain should
appear in /var/log/sssd/sssd_<domain>.log
however i can see
> 'Search result: Operations error(1), 00000000: LdapErr: DSID-0C090627,
> comment: In order to perform this operation a successful bind must be
> completed on the connection., data 0, vece'
> which suggest that i cannot bind to ldap, right ?
Would you mind including the LDAP portion of your sssd.conf? This issue
seems to be with LDAP, not Kerberos.
>
> Any suggestions where to go from here, ?
>
> Best regards,
> Patrik Martinsson, Sweden.
>
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxW0nUACgkQeiVVYja6o6NyhwCfdEn0TqA/UlwaaxZGH5k3E+oT
QEYAnR87flpKlSpgrABs9w/qcwqV2NVd
=L9GF
-----END PGP SIGNATURE-----
More information about the sssd-devel
mailing list