Bug 1001310

Summary: Cached credentials aren't working with sssd-ad UPN logins
Product: [Fedora] Fedora Reporter: Colin.Simpson
Component: sssdAssignee: Jakub Hrozek <jhrozek>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 19CC: abokovoy, jhrozek, lslebodn, okos, pbrezina, sbose, sgallagh, ssorce
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: sssd-1.11.1-1.fc19 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-10-01 02:16:23 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
sssd.conf none

Description Colin.Simpson 2013-08-26 21:02:28 UTC 
Description of problem:

Using SSSD AD and a UPN username login (i.e where the UPN name doesn't equal the domain name) succeeds correctly when connected to the network. However the user in unable to login when offline. Cached credentials aren't working.

Version-Release number of selected component (if applicable):
sssd-1.11.0-0.1.beta2.fc19.x86_64

How reproducible:
Everytime

Steps to Reproduce:
1.Login whilst connected to the network
2.Logout
3.Disconnect network cable
4.Attempt to login when off the network

Actual results:
Unable to login off the network

Expected results:
Login succeeds off the network

Additional info:

I can't guarantee this is due to UPN logins, but I'm guessing due to presumably cached credentials working for users on simpler domains. I have no way of testing this.

My very un-sssd expert eyes seem to indicate that sssd is losing the username (lots of name "(unknown)" appearing) somewhere in the process.

(Mon Aug 26 19:08:08 2013) [sssd[nss]] [check_cache] (0x0400): Cached entry is valid, returning..
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_initgroups_search] (0x0400): Initgroups for [colin] completed
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7f08383b83d0][20]ion
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7f08383b83d0][20]
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [17] with input [(unknown)].
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name '(unknown)' matched without domain, user is (unknown)
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)]
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [(unknown)] from [<ALL>]
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/USER/iongeo.lan/(unknown)]
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0400): User [(unknown)] does not exist in [iongeo.lan]! (negative cache)
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0080): No matching domain found for [(unknown)], fail!
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7f08383b83d0][20]
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7f08383b83d0][20]
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [17] with input [(unknown)].
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name '(unknown)' matched without domain, user is (unknown)
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)]
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [(unknown)] from [<ALL>]
Comment 1 Colin.Simpson 2013-08-26 21:03:45 UTC 
Created attachment 790691 [details]
sssd.conf
Comment 2 Sumit Bose 2013-08-27 08:01:30 UTC 
Can you attach the full logs of a successful and a failed attempt?
Comment 3 Jakub Hrozek 2013-08-27 08:42:02 UTC 
(In reply to Sumit Bose from comment #2)
> Can you attach the full logs of a successful and a failed attempt?

Sent privately.
Comment 4 Sumit Bose 2013-08-27 10:27:09 UTC 
Thank you for the logs. they are very helpful.

You are right, it is related to the UPNs you are using. The UPNs are not the "real" Kerberos principals but an alias which gets canonicalized by the AD KDC. SSSD stores the canonicalized version after a successful authentication but, since we store it in the same attribute as the UPN read from AD it gets overwritten.

In the offline case we end up with the alias UPN which we cannot map back to the canonicalized version, which is used e.g. in the credential cache.

To fix this the canonical UPN should be saved in a separate attribute in the cache and used when needed and available.
Comment 5 Jakub Hrozek 2013-08-27 11:07:58 UTC 
Upstream ticket:
https://fedorahosted.org/sssd/ticket/2060
Comment 6 Jakub Hrozek 2013-09-23 15:04:44 UTC 
Fixed upstream.
Comment 7 Fedora Update System 2013-09-27 21:09:48 UTC 
sssd-1.11.1-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/sssd-1.11.1-1.fc19
Comment 8 Fedora Update System 2013-09-29 01:27:06 UTC 
Package sssd-1.11.1-1.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing sssd-1.11.1-1.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-17879/sssd-1.11.1-1.fc19
then log in and leave karma (feedback).
Comment 9 Fedora Update System 2013-10-01 02:16:23 UTC 
sssd-1.11.1-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.