[SSSD] sssd and kerberos.

Stephen Gallagher sgallagh at redhat.com
Mon Aug 2 14:13:09 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/02/2010 10:06 AM, Patrik Martinsson wrote:
> Hello,
> 
> I've successfully setup'ed sssd on our systems to connect to our 
> Microsoft AD with ldap
> authentication, now i want to use kerberos instead, and have I of course 
> ran into some problems :)
> 
> To start with, I'm not to familiar with kerberos so go easy on me here.
> 
> I've successfully created a machineaccount in AD (with msktutil, also 
> got it working with samba/net join)
> and obtained a kerberos keytab. A user can obtain a ticket by running 
> 'kinit foouser', thereafter he/she
> can run for example 'ldapsearch -b 'ou=xx,dc=xx,dc=xx,dc=xx' -Omaxssf=0 
> "(&(objectclass=user)(cn=xx))" uid'
> successfully.
> 
> Here's to my question, (maybe this rather should be in a kerberos 
> mailinglist, or maybe i should read a book however it's easiest to ask 
> here :))
> Is the keytab used by sssd to authenticate to the kdc, is this even how 
> it works ? Since the sssd is runned by root and root has no ticket,
> i figured it would work that way, but maybe I'm mistaken, maybe it's 
> suppose to work in some other way ?
> 

SSSD does not authenticate against a KDC. We can validate the TGT with a
host keytab, however (this proves that the response came from a real
KDC). This would be done by setting:
krb5_keytab = /etc/krb5.keytab
krb5_validate = True

That said, I think this is irrelevant to the issue at hand.

> Here's the krb5 part of the sssd.conf
> auth_provider = krb5
> krb5_kdcip = 123.123.123.123
> krb5_realm = foo
> krb5_changepw_principle = kadmin/changepw
> krb5_ccachedir = /tmp
> krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
> krb5_auth_timeout = 15
> krb5_keytab = /etc/krb5.keytab
> 
> When i start sssd with -d10 i cant really see much messages about the 
> kerberos authentication whether it fails or not, 

Instead of starting with -d10, start with --debug-to-files and look in
/var/log/sssd. Kerberos authentication errors will appear in
/var/log/sssd/krb5_child.log and all other errors for this domain should
appear in /var/log/sssd/sssd_<domain>.log

however i can see
> 'Search result: Operations error(1), 00000000: LdapErr: DSID-0C090627, 
> comment: In order to perform this operation a successful bind must be 
> completed on the connection., data 0, vece'
> which suggest that i cannot bind to ldap, right ?

Would you mind including the LDAP portion of your sssd.conf? This issue
seems to be with LDAP, not Kerberos.

> 
> Any suggestions where to go from here, ?
> 
> Best regards,
> Patrik Martinsson, Sweden.
> 
> 
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel


- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkxW0nUACgkQeiVVYja6o6NyhwCfdEn0TqA/UlwaaxZGH5k3E+oT
QEYAnR87flpKlSpgrABs9w/qcwqV2NVd
=L9GF
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list