[SSSD] pam_krb5 & wrong principal in request

Ondrej Valousek webserv at s3group.cz
Thu Mar 1 14:23:39 UTC 2012


Got it finally working by re-creating /etc/krb5.keytab file from the scratch.
It turned out, that I did not use Samba to join the machine to AD, but I used Centrify.

There is nothing wrong with that, the only thing is, that unlike Samba & SSSD, Centrify does refresh principals in /etc/krb5.keytab creating 
multiple principals in keytab that differ only by the KVNO number.

This is nice, but both sshd & pam_krb5.so seem to totally ignore KVNOs, picking the first principal they find in keytab.

So I am going to file RH bugzilla report

Ondrej
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120301/82341470/attachment.html>


More information about the sssd-devel mailing list