[SSSD] SSSD GSSAPI Question

Jakub Hrozek jhrozek at redhat.com
Fri Feb 1 09:37:41 UTC 2013


On Thu, Jan 31, 2013 at 03:10:16PM -0500, Derek Page wrote:
> Hi Devs,
> 
> I am using SSSD with kerberos with gssapi auth and it works really
> well for our environment using AD for authentication.
> 
> I am not sure if this is an SSSD issue but I though I would ask since
> I can't find a solution anywhere.
> SSH'ing from system to system works great using GSSAPI passing along
> your kerberos ticket. But seems to only work with its FQDN or
> shortname.
> 
> The issue I have is we run Virtual IP's with different A records that
> point to services for our systems. When I ssh to one of these A
> records Kerberos/sssd seems to reject and GSSAPI authenticaion that is
> not directed due to reverse dns mismatch.
> 
> I have disabled reverse rdns in kerberos.
> 
> I think this could also be the issue.
> ldap_sasl_authid = M4DEPLOY01$@MY.DOMAIN.COM
> 

This principal is only used in the SSSD to establish a secure connection
towards the LDAP server for identity lookups, nothing to do with
authentication.

> Is there a way to tell sssd to accept anything?
> Let me know if this is not an SSSD issue and I will leave you guys
> along. However we really need this to work otherwise I have to go back
> to using SSH keys, which I really don't want to. I really like the
> security of krb tickets.

If you already have a ticket and are using GSSAPI ticket forwarding,
then I don't think the SSSD is involved.

Without actual knowledge of your environment, could it be that the
domain_realm mappings are wrong on the clients and so Kerberos doesn't
know that the ticket you posses should matches the domain you log in to?

In other words, are all the clients you are logging to in the domain
.mydomain.com and Kerberos realm MYDOMAIN.COM?



More information about the sssd-devel mailing list