Bug 1001310
Summary: | Cached credentials aren't working with sssd-ad UPN logins | ||||||
---|---|---|---|---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Colin.Simpson | ||||
Component: | sssd | Assignee: | Jakub Hrozek <jhrozek> | ||||
Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
Severity: | medium | Docs Contact: | |||||
Priority: | unspecified | ||||||
Version: | 19 | CC: | abokovoy, jhrozek, lslebodn, okos, pbrezina, sbose, sgallagh, ssorce | ||||
Target Milestone: | --- | ||||||
Target Release: | --- | ||||||
Hardware: | Unspecified | ||||||
OS: | Linux | ||||||
Whiteboard: | |||||||
Fixed In Version: | sssd-1.11.1-1.fc19 | Doc Type: | Bug Fix | ||||
Doc Text: | Story Points: | --- | |||||
Clone Of: | Environment: | ||||||
Last Closed: | 2013-10-01 02:16:23 UTC | Type: | Bug | ||||
Regression: | --- | Mount Type: | --- | ||||
Documentation: | --- | CRM: | |||||
Verified Versions: | Category: | --- | |||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
Cloudforms Team: | --- | Target Upstream Version: | |||||
Embargoed: | |||||||
Attachments: |
|
Description
Colin.Simpson
2013-08-26 21:02:28 UTC
Created attachment 790691 [details]
sssd.conf
Can you attach the full logs of a successful and a failed attempt? (In reply to Sumit Bose from comment #2) > Can you attach the full logs of a successful and a failed attempt? Sent privately. Thank you for the logs. they are very helpful. You are right, it is related to the UPNs you are using. The UPNs are not the "real" Kerberos principals but an alias which gets canonicalized by the AD KDC. SSSD stores the canonicalized version after a successful authentication but, since we store it in the same attribute as the UPN read from AD it gets overwritten. In the offline case we end up with the alias UPN which we cannot map back to the canonicalized version, which is used e.g. in the credential cache. To fix this the canonical UPN should be saved in a separate attribute in the cache and used when needed and available. Upstream ticket: https://fedorahosted.org/sssd/ticket/2060 Fixed upstream. sssd-1.11.1-1.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/sssd-1.11.1-1.fc19 Package sssd-1.11.1-1.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing sssd-1.11.1-1.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-17879/sssd-1.11.1-1.fc19 then log in and leave karma (feedback). sssd-1.11.1-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report. |