[SSSD] Kerb credential cache not getting into default_cache.ldb

Stephen Gallagher sgallagh at redhat.com
Tue Jun 14 13:29:22 UTC 2011


On Tue, 2011-06-14 at 09:15 -0400, Norman Elton wrote:
> Stephen / Sumit,
> 
> Thanks for your responses...
> 
> > This sounds like pam_krb5 is still called somewhere in your pam stack
> > and doing authentication instead of sssd.
> 
> It does seem that way, but grep'ing through /etc/pam.d/* reveals no
> instances of krb. I rebooted the box just to make sure nothing was
> hanging around from before.
> 
> > Could you send the (sanitized) sssd_default.log of the login?
> 
> Attached. I'll also attach my sssd.conf, sshd_config, and
> /etc/pam.d/system-auth (which is identical to password-auth).
> 
> In my sshd_config, I've still got GSSAPIAuthentication enabled. Is
> this somehow bypassing sssd? I tried disabling it and leaving UsePAM
> enabled, and couldn't login with my kerb ticket.


Yes, sshd does not call pam_authenticate() (and therefore does not
contact SSSD) when using GSSAPIAuthentication (because the user is
already authenticated by their TGT). As you can see from your logs, it
only called pam_account() for access-control requests.

This is expected behavior. SSSD cannot manage automatic ticket renewal
on systems logged into by GSSAPI (because we're not involved in the
authentication step)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110614/c99afe57/attachment.sig>


More information about the sssd-devel mailing list