Bug 1372956

Created attachment 1197605 [details]
SSSD Domain log file

Description of problem:
This issue was observed during the automated execution of bug 773660. A clock skew event should fail kerberos user authentication and error should be logged. However, user auth succeeds. 

Version-Release number of selected component (if applicable):
sssd-1.14.0-34.el7.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Setup a 389DS LDAP server and KRB server.

2. Add a testuser to LDAP server and add the same user to KRB server. See cmd below:
 # kadmin.local -q "addprinc -pw Secret123 +requires_preauth a1m2user"

3. Setup a RHEL-7.3 SSSD client system with the following configuration:

SSSD.CONF File
--------------------------------------
[sssd]
reconnection_retries = 3
config_file_version = 2
sbus_timeout = 30
services = nss, pam
domains = KRB

[domain/KRB]
id_provider = ldap
ldap_tls_reqcert = hard
ldap_uri = ldap://<LDAP_SERVER>
ldap_search_base = dc=example,dc=com

enumerate = TRUE
cache_credentials = TRUE
debug_level = 9

auth_provider = krb5
krb5_server = <KRB_SERVER>
krb5_realm = EXAMPLE.COM
chpass_provider = krb5

4. Set kdc_timesync = 0 in /etc/krb5.conf file.

# cat /etc/krb5.conf
 Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log
 kdc_timesync = 0

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 default_realm = EXAMPLE.COM
 default_ccache_name = KEYRING:persistent:%{uid}

[realms]
 EXAMPLE.COM = {
  kdc = hp-dl380pgen8-02-vm-9.lab.bos.redhat.com
  admin_server = hp-dl380pgen8-02-vm-9.lab.bos.redhat.com
 }

[domain_realm]
 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM


5. Restart SSSD service and set the date to a future one.

Current date:
# date
Sun Sep  4 05:56:14 EDT 2016

Set date to a future:
# date -s "`date -d "+1 day"`"
Mon Sep  5 05:56:17 EDT 2016

6. Execute user authentication (auth succeeds instead of failing due to clock skew).

# ssh -l a1m2user localhost
a1m2user@localhost's password: 
Last login: Mon Sep  5 05:56:48 2016 from localhost
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
         This System is part of the Red Hat Test System.              
                                                                      
      Please do not use this system for individual unit testing.      
                                                                      
      RHTS Test information:                                          
                         HOSTNAME=auto-hv-02-guest08.idmqe.lab.eng.bos.redhat.com                           
                            JOBID=1486675                              
                         RECIPEID=3038029                           
                       LAB_SERVER=                         
                    RESULT_SERVER=[::1]:7081                      
                           DISTRO=RHEL-7.3-20160902.n.0                             
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
Could not chdir to home directory /home/a1m2user: No such file or directory
/usr/bin/id: cannot find name for group ID 10341
-sh-4.2$ date
Mon Sep  5 06:02:31 EDT 2016
-sh-4.2$ logout
Connection to localhost closed.


Actual results:
User auth succeeds.

Expected results:
Authentication should fail and a clock skew error should be logged.

Additional info:

I have attached syslog, sssd_domain log and krb5_child.log file.