[SSSD] Kerb credential cache not getting into default_cache.ldb
Simo Sorce
simo at redhat.com
Tue Jun 14 14:40:42 UTC 2011
On Tue, 2011-06-14 at 09:29 -0400, Stephen Gallagher wrote:
> On Tue, 2011-06-14 at 09:15 -0400, Norman Elton wrote:
> > Stephen / Sumit,
> >
> > Thanks for your responses...
> >
> > > This sounds like pam_krb5 is still called somewhere in your pam stack
> > > and doing authentication instead of sssd.
> >
> > It does seem that way, but grep'ing through /etc/pam.d/* reveals no
> > instances of krb. I rebooted the box just to make sure nothing was
> > hanging around from before.
> >
> > > Could you send the (sanitized) sssd_default.log of the login?
> >
> > Attached. I'll also attach my sssd.conf, sshd_config, and
> > /etc/pam.d/system-auth (which is identical to password-auth).
> >
> > In my sshd_config, I've still got GSSAPIAuthentication enabled. Is
> > this somehow bypassing sssd? I tried disabling it and leaving UsePAM
> > enabled, and couldn't login with my kerb ticket.
>
>
> Yes, sshd does not call pam_authenticate() (and therefore does not
> contact SSSD) when using GSSAPIAuthentication (because the user is
> already authenticated by their TGT). As you can see from your logs, it
> only called pam_account() for access-control requests.
>
> This is expected behavior. SSSD cannot manage automatic ticket renewal
> on systems logged into by GSSAPI (because we're not involved in the
> authentication step)
We could still do something about it by reading the env variable and
sending it to sssd when the pam_account step is done.
Norman if you think this is a feature you need you can open a RFE
request on sssd track and we will see if it can be implemented in one of
the future versions of sssd.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list