Bug 2148737

Summary:	UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
Product:	Red Hat Enterprise Linux 9	Reporter:	Alexey Tikhonov <atikhono>
Component:	sssd	Assignee:	Sumit Bose <sbose>
Status:	CLOSED ERRATA	QA Contact:	Jakub Vavra <jvavra>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	9.1	CC:	jvavra, pasik, pbrezina, sgadekar, tscherf
Target Milestone:	rc	Keywords:	Triaged, ZStream
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	sync-to-jira
Fixed In Version:	sssd-2.8.2-1.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	2148988 (view as bug list)		Environment:
Last Closed:	2023-05-09 08:20:01 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2148988

Description Alexey Tikhonov 2022-11-27 16:07:26 UTC

This bug was initially created as a copy of Bug #2144491

I am copying this bug because: to track fix for RHEL9



Description of problem:

UPN check cannot be disabled explicitly but requires krb5_validate = false' as a workaround

The first is
that the UPN check cannot be disabled explicitly but requires
'krb5_validate = false' as a work-around, this is already fixed
by the test build provided by Sumit 

Version-Release number of selected component (if applicable):

RHEL 8.7

sssd-2.7.3-4.el8_7.1.x86_64

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:

Failed login with AD user on IPA client

From sssd_pac.log

-----
   *  (2022-11-16  6:54:57): [pac] [cache_req_done] (0x0400): [CID#2] CR #0: Finished: Success
   *  (2022-11-16  6:54:57): [pac] [check_upn_and_sid_from_user_and_pac] (0x0020): [CID#2] UPN of user entry and PAC do not match.
********************** BACKTRACE DUMP ENDS HERE *********************************

(2022-11-16  6:55:08): [pac] [check_upn_and_sid_from_user_and_pac] (0x0020): [CID#4] UPN of user entry and PAC do not match.
   *  ... skipping repetitive backtrace ...
(2022-11-16  6:55:21): [pac] [check_upn_and_sid_from_user_and_pac] (0x0020): [CID#6] UPN of user entry and PAC do not match.
   *  ... skipping repetitive backtrace ...
(2022-11-16  6:55:31): [pac] [check_upn_and_sid_from_user_and_pac] (0x0020): [CID#8] UPN of user entry and PAC do not match.
   *  ... skipping repetitive backtrace ...
(2022-11-16  6:55:43): [pac] [check_upn_and_sid_from_user_and_pac] (0x0020): [CID#10] UPN of user entry and PAC do not match.
-----

Expected results:

With the test build.

------
(2022-11-17  4:03:50): [pac] [check_upn_and_sid_from_user_and_pac] (0x4000): [CID#2] UPN of user entry [abroy.COM] and PAC [Abhijit.Roy.com] do not match, ignored. <---
(2022-11-17  4:03:50): [pac] [sysdb_ldb_msg_difference] (0x2000): [CID#2] Added attr [pacBlob] to entry [name=aduser1.COM,cn=users,cn=AD.EXAMPLE.COM,cn=sysdb]
(2022-11-17  4:03:50): [pac] [sysdb_set_entry_attr] (0x0200): [CID#2] Entry [name=aduser1.COM,cn=users,cn=AD.EXAMPLE.COM,cn=sysdb] has set [cache, ts_cache] attrs.
------

Now, sssd is able to ignore the `UPN of user entry [abroy.COM] and PAC [Abhijit.Roy] do not match, ignored`


Additional info:

Comment 1 Alexey Tikhonov 2022-11-27 16:13:49 UTC

Upstream PR: https://github.com/SSSD/sssd/pull/6452

Comment 5 Alexey Tikhonov 2022-11-30 16:05:06 UTC

Pushed PR: https://github.com/SSSD/sssd/pull/6452

* `master`
    * 51b11db8b99a77ba5ccf6f850c2e81b5a6ee9f79 - pac: relax default check
    * b3d7a4f6d4e1d4fa1bd33b296cd4301973f1860c - ipa: do not add guessed principal to the cache
    * 91789449b7a8b20056e1edfedd8f8cf92f7a0a2a - PAC: allow to disable UPN check
* `sssd-2-8`
    * 35a28524e407bf4b05a17c7c7f0b48799a18e8bf - pac: relax default check
    * a3304cc6b27b2f0678d0dcb4130865aa09442f5d - ipa: do not add guessed principal to the cache
    * b00c72d29b172a91b3eac5bc7b8ed275b883ec61 - PAC: allow to disable UPN check

Comment 12 errata-xmlrpc 2023-05-09 08:20:01 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sssd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2514