[SSSD] Kerb credential cache not getting into default_cache.ldb

Simo Sorce simo at redhat.com
Tue Jun 14 14:40:42 UTC 2011


On Tue, 2011-06-14 at 09:29 -0400, Stephen Gallagher wrote:
> On Tue, 2011-06-14 at 09:15 -0400, Norman Elton wrote:
> > Stephen / Sumit,
> > 
> > Thanks for your responses...
> > 
> > > This sounds like pam_krb5 is still called somewhere in your pam stack
> > > and doing authentication instead of sssd.
> > 
> > It does seem that way, but grep'ing through /etc/pam.d/* reveals no
> > instances of krb. I rebooted the box just to make sure nothing was
> > hanging around from before.
> > 
> > > Could you send the (sanitized) sssd_default.log of the login?
> > 
> > Attached. I'll also attach my sssd.conf, sshd_config, and
> > /etc/pam.d/system-auth (which is identical to password-auth).
> > 
> > In my sshd_config, I've still got GSSAPIAuthentication enabled. Is
> > this somehow bypassing sssd? I tried disabling it and leaving UsePAM
> > enabled, and couldn't login with my kerb ticket.
> 
> 
> Yes, sshd does not call pam_authenticate() (and therefore does not
> contact SSSD) when using GSSAPIAuthentication (because the user is
> already authenticated by their TGT). As you can see from your logs, it
> only called pam_account() for access-control requests.
> 
> This is expected behavior. SSSD cannot manage automatic ticket renewal
> on systems logged into by GSSAPI (because we're not involved in the
> authentication step)

We could still do something about it by reading the env variable and
sending it to sssd when the pam_account step is done.

Norman if you think this is a feature you need you can open a RFE
request on sssd track and we will see if it can be implemented in one of
the future versions of sssd.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list