[SSSD] KRB5CCNAME variable broken in second concurrent login shell - bug?

Joschi Brauchle joschi.brauchle at tum.de
Wed Oct 15 12:37:59 UTC 2014


We have a weird problem with the KRB5CCNAME environment variable that 
seems to be an SSSD bug.

Configuration:
------------ /etc/sssd/sssd.conf ------------
...
# Set CCache to Kerberos default
krb5_ccachedir = /run/user/%U
krb5_ccname_template = DIR:%d/krb5cc
...
------------ /etc/sssd/sssd.conf ------------

Now, user "ne96soh" logs in to the machine for the FIRST time and does a 
kerberized ldapsearch:
------------
ne96soh at tueilnt-student01:~$ echo $KRB5CCNAME
DIR:/run/user/3036404/krb5cc
ne96soh at tueilnt-student01:~$ klist
Ticket cache: DIR::/run/user/3036404/krb5cc/tktZoweZq
...
ne96soh at tueilnt-student01:~$ ldapsearch ...<using GSSAPI>
... <succeeds>
------------

but then logs into the machine a SECOND concurrent time (i.e. leaving 
first session open):
------------
ne96soh at tueilnt-student01:~$ echo $KRB5CCNAME
DIR::/run/user/3036404/krb5cc/tktZoweZq
ne96soh at tueilnt-student01:~$ klist
Ticket cache: DIR::/run/user/3036404/krb5cc/tktZoweZq
...
ne96soh at tueilnt-student01:~$ ldapsearch ...<using GSSAPI>
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
         additional info: SASL(-1): generic failure: GSSAPI Error: 
Unspecified GSS failure.  Minor code may provide more information (No 
Kerberos credentials available)
------------

For me, the format of 'DIR::/run/user/3036404/krb5cc/tktZoweZq' in the 
second login seems strange! Is this a valid format?

When I manuelly reset the KRB5CCNAME variable in the second login shell 
to its original value 'DIR:/run/user/3036404/krb5cc', then the 
ldapsearch using GSSAPI succeeds.

The reason of all this seems to be that SSSD reuses existing ccaches for 
already logged on users, but possibly mixes up formats there.
See
------------ /var/log/sssd_default.log ------------
(Wed Oct 15 14:04:54 2014) [sssd[be[default]]] [krb5_auth_send] 
(0x4000): Ccache_file is [DIR::/run/user/3036404/krb5cc/tktZoweZq] and 
is  active and TGT is  valid.
...
(Wed Oct 15 14:04:54 2014) [sssd[be[default]]] [krb5_find_ccache_step] 
(0x0080): Saved ccache DIR::/run/user/3036404/krb5cc/tktZoweZq if of 
different type than ccache in configuration file, reusing the old ccache
...
(Wed Oct 15 14:04:54 2014) [sssd[be[default]]] 
[safe_remove_old_ccache_file] (0x0400): New and old ccache file are the 
same, no one will be deleted.
(Wed Oct 15 14:04:54 2014) [sssd[be[default]]] [krb5_mod_ccname] 
(0x4000): Save ccname [DIR::/run/user/3036404/krb5cc/tktZoweZq] for user 
[ne96soh].
------------ /var/log/sssd_default.log ------------

Best regards,
-- 
Dipl.-Ing. Joschi Brauchle, M.S.

Institute for Communications Engineering (LNT)
Technische Universitaet Muenchen (TUM)
80290 Munich, Germany

Tel (work): +49 89 289-23474
Fax (work): +49 89 289-23490
E-mail: joschi.brauchle at tum.de
Web: http://www.lnt.ei.tum.de/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4917 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20141015/e4b6c0c6/attachment.p7s>


More information about the sssd-devel mailing list