[SSSD-users] get_and_save_tgt :Preauthentication failed on debian 7 + sssd 1.8.4 againts a samba 4 host

Lukas Slebodnik lslebodn at redhat.com
Sat Jun 13 19:03:18 UTC 2015


On (13/06/15 20:24), thierry DeTheGeek wrote:
>Hi
>
>I'm working on a centalized user accounts setup, thanks to samba 4
>
>SSSD is setup on a Debian 7 host, version 1.8.4 as provided by the
I would suggest to use Debian stable (Jessie)
It contains sssd-1.11.7 which has many bug-fixes.
and moreover it has ad_provider which will simplify your configuration.

>repository. This host will authenticate users agains several domains :
>INTRA.DOMAIN-A.COM and INTRA.DOMAIN-B.COM. The later domain is not set up
>yet because this work will be nearly a copy/paste from the first one.
>
>I need to make my users authenticate with a login in the form
>jdoe at domain-a.com . This will prevent a conflict if the user jdoe exists on
>both domains.
In this case, you might want to enable option use_fully_qualified_names.
details are in manual page sssd.conf

>
>Notice I want to drop the "intra." part in the login; making my users not
>bored with technical details.
>
With fully qualified names the domain part is taken from the name
of domain section in sssd.conf "[domain/domain-a.com]"
So it neen't be the same as REALM.

>I built successfully a sssd.conf in a Debian Jessie host, but when
>reproducing the setup on Debian 7, user authentication fails.
>
>Here is the sssd.conf file, with password and domain not revealed,
>
>[sssd]
>config_file_version = 2
>reconnection_retries = 3
>sbus_timeout = 30
>services = nss, pam
>domains = domain-a.com
>
>[nss]
>filter_groups = root
>filter_users = root
>reconnection_retries = 3
># entry_cache_nowait_percentage = 300
>
>[pam]
>reconnection_retries = 3
>
># Example LOCAL domain that stores all users natively in the SSSD internal
># directory. These local users and groups are not visible in /etc/passwd; it
># now contains only root and system accounts.
># [domain/LOCAL]
># description = LOCAL Users domain
># id_provider = local
># enumerate = true
># min_id = 500
># max_id = 999
>
>[domain/domain-a.com]
>; Using enumerate = true leads to high load and slow response
>enumerate = true
>cache_credentials = false
>entry_cache_timeout = 5400
># account_cache_expiration = 365
>
>id_provider = ldap
>auth_provider = krb5
>chpass_provider = krb5
>
>ldap_uri = ldap://intra.domain-a.com
>ldap_tls_reqcert = demand
>ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
>ldap_schema = rfc2307bis
>ldap_default_bind_dn = cn=ldap-deb7,cn=users,dc=intra,dc=domain-a,dc=com
>ldap_default_authok_type = password
>ldap_default_authtok = p at ssw0rd
>ldap_search_base = cn=users,cn=users,dc=intra,dc=domain-a,dc=com
>ldap_user_object_class = person
>#ldap_user_principal = userPrincipalName
>ldap_user_principal = sAMAccountname
>ldap_group_object_class = group
>ldap_user_home_directory = unixHomeDirectory
>ldap_force_upper_case_realm = true
>
>krb5_server = intra.domain-a.com
>krb5_realm = INTRA.DOMAIN-A.COM
>krb5_changepw_principle = kadmin/changepw
>krb5_auth_timeout = 15
>use_fully_qualified_names = true
Ahh you already used it :-)

># re_expression =
>((intra\.(?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@$
># full_name_format = %1$s at intra.%2$s
># not available on Wheezy - sssd < 1.9.0
># override_shell = /usr/sbin/nologin
>override_homedir = /media/homedrive/%d/users/%u
>
>- gentent passwd shows my users
>- kinit jdoe at INTRA.DOMAIN-A.COM asks for password and succeeds
>- If logged as root, su jdoe at intra.domain-a.com succeeds
>- ssh localhost -l jdoe at domain-a.com fails
>
>running sssd -i -d 0xFFF0 shows a huge amount of log, and it appears that
>kerberos authentication fails.
>
>(Sat Jun 13 20:16:10 2015) [sssd[be[domain-a.com]]] [become_user] (0x4000):
>Trying to become user [10000][10001].
>(Sat Jun 13 20:16:10 2015) [sssd[be[domain-a.com]]] [child_handler_setup]
>(0x2000): Signal handler set up for pid [30421]
>(Sat Jun 13 20:16:10 2015) [sssd[be[domain-a.com]]] [write_pipe_handler]
>(0x0400): All data has been sent!
>(Sat Jun 13 20:16:10 2015) [[sssd[krb5_child[30421]]]] [main] (0x0400):
>krb5_child started.
>(Sat Jun 13 20:16:10 2015) [[sssd[krb5_child[30421]]]] [krb5_child_setup]
>(0x1000): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.
>(Sat Jun 13 20:16:10 2015) [[sssd[krb5_child[30421]]]] [krb5_child_setup]
>(0x1000): Cannot read [SSSD_KRB5_LIFETIME] from environment.
>(Sat Jun 13 20:16:10 2015) [[sssd[krb5_child[30421]]]] [krb5_child_setup]
>(0x4000): Not using FAST.
>(Sat Jun 13 20:16:11 2015) [[sssd[krb5_child[30421]]]] [get_and_save_tgt]
>(0x0020): 682: [-1765328360][Preauthentication failed]
>(Sat Jun 13 20:16:11 2015) [[sssd[krb5_child[30421]]]] [tgt_req_child]
>(0x0020): 944: [-1765328360][Preauthentication failed]
Even thought you enabled all debug levels.
It's not clear to me why there is "Preauthentication failed"
krb5_child should do the same as "kinit jdoe at INTRA.DOMAIN-A.COM"
which works for you.
I do not remeber any related bug but you have quite old sssd (1.8.4)
Maybe other sssd developers remeber one.

>(Sat Jun 13 20:16:11 2015) [sssd[be[domain-a.com]]] [read_pipe_handler]
>(0x0400): EOF received, client finished
>(Sat Jun 13 20:16:11 2015) [sssd[be[domain-a.com]]] [krb5_child_done]
>(0x4000): child response [17][1][25].
>(Sat Jun 13 20:16:11 2015) [sssd[be[domain-a.com]]] [check_wait_queue]
>(0x1000): Wait queue for user [jdoe] is empty.
>(Sat Jun 13 20:16:11 2015) [sssd[be[domain-a.com]]]
>[be_pam_handler_callback] (0x0100): Backend returned: (0, 17, <NULL>)
>[Success]
>(Sat Jun 13 20:16:11 2015) [sssd[be[domain-a.com]]]
>[be_pam_handler_callback] (0x0100): Sending result [17][domain-a.com]
>(Sat Jun 13 20:16:11 2015) [sssd[be[domain-a.com]]]
>[be_pam_handler_callback] (0x0100): Sent result [17][domain-a.com]
The pam error code 17 is PAM_CRED_ERR "Failure setting user credentials"


>I think my issue is here, but I don't know how to check the kerberos
>authenticationn. I'm suspecting sssd sends something with the wrong domain
>part.
>
>I got a LXC container running Debian 8, and this setup seems to work
>exactly as I'm expecting.
As I alredy mentioned debian stable has newer versin of sssd 1.11.7
BTW debian stable has also realmd which simplify configuration
of sssd against AD/samba.

>Any idea on how to trouble shoot my issue ?
You can try to build the latest sssd-1.9.7
and test whether the problem is fixed.
It would be possible to build 1.11.7 on wheezy
but you would need to build sssd without samba libraries
--without-samba. It should not be problem for you
because you do not use ad or ipa providers.

LS


More information about the sssd-users mailing list