[SSSD] Access denied by pam_sss(sshd:account)

Jakub Hrozek jakub.hrozek at gmail.com
Mon Jul 1 07:32:45 UTC 2013


On Fri, 2013-06-28 at 10:39 -0400, Dmitri Pal wrote:
> >> Also in 1.10 SSSD should support transitive trusts so if there is a
> >> trust between the domains SSSD 1.10 should be able to authenticate users
> >> from both domains.
> > You can use the TGT to access both trusted domains in a trust, but the
> > TGT must be obtained from the KDC you are enrolled with. At least
> > with AD, because there are no krb5-master SRV records by default on the
> > AD side, so the libkrb5 has no means of asking who to contact to if the
> > keytab is not local to the domain. One could work around by adding the
> > SRV records or adding the master_kdc option to krb5.conf, but the AD
> > provider only talks to the local KDC when acquiring a TGT by default.
> >
> > I learned this the hard way when debugging the trusts in the AD provider
> > recently :)
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> 
> Are you saying that if there are two domins A & B user is from A and
> system is from B and user logs into the system using his user name and
> password (not SSH with GSSAPI) he needs to have additional DNS records?
> My understanding (may be limited) of the flow would be that when you try
> to authenticate the request would go to domain B, it will recognize that
> the user is from trusted domain and issue a cross realm ticket to the
> client and redirect it to domain A. Is this the place where the client
> should be able to resolve the domain A? Would adding local records or
> records into AD DNS solve the problem? Is this what you are suggesting
> above?
> 

Sorry, I forgot to reply earlier, my focus was on releasing 1.11 :)

With the help of enterprise principals you can kinit against any KDC in
the forest and then use the TGT to access any trusted server in the
forest. But at least for acquiring the TGT for LDAP we don't support
enterprise principals at the moment, so we decided to kinit with the KDC
of the SSSD domain, i.e. the KDC the client enrolled with. I don't have
access to the test environment anymore, will have against next week, so
I don't know if "kinit -E" would work automatically without the help of
any additional records. Maybe Sumit can clarify in the meantime..




More information about the sssd-devel mailing list