Bug 1733289

Summary:	Password expiry notifications to AD clients no longer work due to regression from fix for bug 1385665
Product:	Red Hat Enterprise Linux 7	Reporter:	afox <afox>
Component:	krb5	Assignee:	Robbie Harwood <rharwood>
Status:	CLOSED ERRATA	QA Contact:	Filip Dvorak <fdvorak>
Severity:	medium	Docs Contact:	lmcgarry
Priority:	unspecified
Version:	7.6	CC:	dpal, fdvorak, fhanzelk, grajaiya, jhrozek, lmcgarry, lslebodn, mark.crossland, mzidek, pasik, pbrezina, pod.pavel, rharwood, sbose, tscherf
Target Milestone:	rc	Keywords:	TestCaseProvided
Target Release:	---
Hardware:	x86_64
OS:	Linux
URL:	https://github.com/krb5/krb5/pull/1056
Whiteboard:
Fixed In Version:	krb5-1.15.1-50.el7	Doc Type:	Bug Fix
Doc Text:	.Password expiration notifications sent to AD clients using SSSD Previously, Active Directory clients (non-IdM) using SSSD were not sent password expiration notices because of a recent change in the SSSD interface for acquiring Kerberos credentials. The Kerberos interface has been updated and expiration notices are now sent correctly.	Story Points:	---
Clone Of:
Clones:	1805628 1820311 (view as bug list)		Environment:
Last Closed:	2020-09-29 20:19:38 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1805628
Bug Blocks:	1820311

Description afox@redhat.com 2019-07-25 15:37:41 UTC

Description of problem:
Password expiry notifications to AD clients with SSSD no longer work due to regression from fix for bug 1385665.

Version-Release number of selected component (if applicable):
sssd-client-1.16.0-19.el7_5.8.x86_64


How reproducible:
Always

Steps to Reproduce:
1) Configure sssd to use auth_provider=krb5 or ad.
2) Configure short password expiry for user in AD. 

Actual results:
No expiry message is sent to any client e.g. gnome, ssh etc. 

Expected results:
Expiry message should be seen.

Comment 3 Jakub Hrozek 2019-07-26 15:07:09 UTC

My first suggestion would be to not use the private version of krb5_get_init_creds_password() even if it means regressing the other bug.

Looking at how libkrb5 implements the password expiration, we'd need to inspect the AS reply and the only API that libkrb5 publicly makes available that returns struct krb5_kdc_rep is marked as deprecated. So reimplementing the functionality looks non-trivial. But moreover, I'm worried that we would be constantly missing some fixes or changes to the recommended krb5_get_init_creds_password..

Comment 4 Jakub Hrozek 2019-08-07 19:57:35 UTC

To capture the discussion we had last week on our team meeting:
 - we would ask MIT to provide an API to access the needed data
 - in the meantime, we could suggest using auth_provider=krb5. This should have no functional regression compared with auth_provider=ad as long as the following two options are set:
   - krb5_validate = true
   - krb5_use_enterprise_principal = true

Comment 5 Sumit Bose 2020-02-29 15:36:39 UTC

Hi,

it looks like a new API is not strictly needed.

Robbie, can you have a look at https://github.com/sumit-bose/krb5/commit/036888a75c875f4ab4b850967bec47ab421bc276 and let me know if the change makes sense and would be worth for a pull-request.

Thanks.

bye,
Sumit

Comment 6 Robbie Harwood 2020-03-04 16:24:31 UTC

Hi Sumit, I've reviewed it and it looks reasonable to me.  I think we should propose it (I assume you want to do this, but I'm willing to handle it if that's easier).

My understanding is that that change by itself will fix the SSSD issue; is that right?  If so, it seems like we should move this bug to krb5.

Comment 7 Sumit Bose 2020-03-19 13:06:51 UTC

(In reply to Robbie Harwood from comment #6)
> Hi Sumit, I've reviewed it and it looks reasonable to me.  I think we should
> propose it (I assume you want to do this, but I'm willing to handle it if
> that's easier).

Hi Robbie,

thanks for the feedback. I updated the description of krb5_get_init_creds_opt_set_expire_callback() in krb5.hin in the latest version in https://github.com/sumit-bose/krb5/commits/warn_pw_expiry. It looks like the preferred way to contribute is a pull-request on github, I will create one. 

> 
> My understanding is that that change by itself will fix the SSSD issue; is
> that right?  If so, it seems like we should move this bug to krb5.

Yes, with the modified libkrb5 SSSD can receive the password expiration data automatically again, no changes needed on the SSSD side.

bye,
Sumit

Comment 8 Sumit Bose 2020-03-24 14:55:52 UTC

Hi,

I created https://github.com/krb5/krb5/pull/1056 and as suggested by Robbie in comment #6 I move this ticket to krb5. If the pull-request is not accepted please move the ticket back to SSSD so that we can think about alternative solutions.

bye,
Sumit

Comment 24 errata-xmlrpc 2020-09-29 20:19:38 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (krb5 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3982