[SSSD] SSSD and Kerberos

Jakub Hrozek jhrozek at redhat.com
Tue Jan 3 10:07:29 UTC 2012


On Tue, Jan 03, 2012 at 01:13:53AM -0600, Alexander Blair wrote:
> Hello,
> 
> I got a chance to work on this/look into this, and getent passwd
> user is returning the expected results with sssd on, and nothing
> with sssd off, as should be expected.  The addition or removal of
> the / on the ldap URL had no results on my testing.
> 
> I tacked strace's onto the various processes as I was
> authenticating, and verified that it did contact the ldap server,
> and was able to get all the ldap related data.  I have also verified
> that the server can contact the Kerberos server at this time via
> kinit after a su <user> -, where <user> is a user that only exists
> in the ldap directory, so it appears that it's something with SSSD
> not properly contacting the Krb server, I'm unable to track exactly
> how it should be doing this, so any suggestions would be
> appreciated, and I'm happy to provide any additional information I
> can about our setup related to this.
> 
> Thank you,
> Alexander Blair
> 

How did you configure your PAM stack? Usin authconfig or manually? Does
/var/log/secure show any errors related to pam_sss (and does it show
that pam_sss was consulted?)

You can also try setting debug_level = 10 in the [domain/domainname]
section of sssd.conf, restarting sssd and checking for any Kerberos errors.



More information about the sssd-devel mailing list