[SSSD] pam_krb5 & wrong principal in request

Ondrej Valousek webserv at s3group.cz
Thu Mar 1 14:49:28 UTC 2012


On 03/01/2012 03:38 PM, John Hodrien wrote:
> On Thu, 1 Mar 2012, Ondrej Valousek wrote:
>
>> Got it finally working by re-creating /etc/krb5.keytab file from the scratch.
>> It turned out, that I did not use Samba to join the machine to AD, but I used Centrify.
>>
>> There is nothing wrong with that, the only thing is, that unlike Samba &
>> SSSD, Centrify does refresh principals in /etc/krb5.keytab creating multiple
>> principals in keytab that differ only by the KVNO number.
>>
>> This is nice, but both sshd & pam_krb5.so seem to totally ignore KVNOs,
>> picking the first principal they find in keytab.
>
> Why would you want to collect the old credentials?  Aren't the credentials
> with the lower KVNOs obsolete?

I am asking this question myself, too :-) . But there must be some reason behind it, otherwise we would not need KVNOs at all.

>
> FYI:https://fedorahosted.org/sssd/ticket/1041  is tracking this
> (scheduled for SSSD 1.11 in 9 months).

Nice, hopefully pam_krb5 would be fixed before then!

Ondrej
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120301/5707eb5e/attachment.html>


More information about the sssd-devel mailing list