[SSSD] Kerb credential cache not getting into default_cache.ldb

Sumit Bose sbose at redhat.com
Tue Jun 14 10:33:33 UTC 2011


On Mon, Jun 13, 2011 at 05:36:07PM -0400, Norman Elton wrote:
> Based on IRC conversations with sgallagh, we determined that my
> ignorance led to /etc/pam.d/system-auth being correctly configured,
> but /etc/pam.d/password-auth left as the defaults. This was causing
> issues with sssd renewing the incorrect kerb credential cache.
> 
> After fixing my password-auth file, I'm still having issues with
> automatic ticket renewal. It seems that, now, the sssd cache database
> is not seeing my kerb credential cache. the ccacheFile is missing,
> even after I log in successfully with kerb. My KRB5CCNAME environment
> variable is set and matches the cache shown in klist.

This sounds like pam_krb5 is still called somewhere in your pam stack
and doing authentication instead of sssd. Can you check the application
specific pam config files like /etc/pam.d/sshd and the genric files
/etc/pam.d/system-auth and /etc/pam.d/password-auth if pam_krb5 is
listen in any of theses ?

HTH

bye,
Sumit


> 
> What would cause sssd to not recognize the cache name? selinux is in
> permissive mode, I tried blowing away my sssd config (deleted all the
> ldb databases) and reconfiguring everything from scratch with
> authconfig. I'm not convinced something is leftover from a previous
> bad config, but am not sure where else to look.
> 
> Thanks for all the help,
> 
> Norman
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list