[SSSD] sssd-ad uses wrong key to verify tgt at login time

Jurjen Bokma j.bokma at rug.nl
Thu Jun 5 14:54:50 UTC 2014


Hi,

I believe the closing of
https://fedorahosted.org/sssd/ticket/1871#comment:2
to be wrong. Jakub Hrozek asked me to bring this up here after I brought it to his attention through
https://bugs.launchpad.net/bugs/1274543

When it logs in to the AD server, sssd uses the first key in the keytab. In my case, that first key is of a 'join account': a special purpose AD account that has permission to join machines to the domain, and nothing else. In particular, it lacks the permissions to list users. Hence it is unfit to be used by sssd for lookups. As soon as I remove the offending key, sssd works fine, by using another key, which happens to work. When I put it back in the keytab (as the first key), sssd stops working again. I second Jakub in the opinion that sssd should select the 'right' principal to use: ldap_sasl_authid or shortname$@realm.
I believe the cause of the problem to be in src/providers/krb5/krb5_child.c in the loop immediately following the comment:
/* We look for the first entry from our realm or take the last one */
Indeed, if I make that loop skip the first key found, everything works as expected, whether the ADJoiner key is in the keytab or not.

This is just an ad-hoc fix for my case of course.

Regards
Jurjen




More information about the sssd-devel mailing list