Bug 2176378

Summary: Activating Session Recording disables IPA/IDM access
Product: Red Hat Enterprise Linux 8 Reporter: Stefan Meyer <smeyer>
Component: cockpit-session-recordingAssignee: jstephen
Status: VERIFIED --- QA Contact: Anuj Borah <aborah>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: ---CC: aborah, aboscatt, atikhono, jbreitwe, spoore
Target Milestone: rcKeywords: Triaged
Target Release: 8.9   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 2187510 (view as bug list) Environment:
Last Closed: Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version: v13
Embargoed:
Bug Depends On:    
Bug Blocks: 2187510    

Description Stefan Meyer 2023-03-08 08:21:40 UTC 
Description of problem:
- Activating Session Recording disables IPA/IDM access

Version-Release number of selected component (if applicable):
- RHEL 8.7
- cockpit-session-recording-12-1.el8.noarch


How reproducible:


Steps to Reproduce:
1. enable IPA/IDM login on a client
2. Install cockpit-session-recording: yum install cockpit-session-recording
   No file /etc/sssd/conf.d/sssd-session-recording.conf is created by default
3. Go to Cockpit web page and select
4. Set the SSSD Config to Scope = All
5. Save configuration
   The file /etc/sssd/conf.d/sssd-session-recording.conf is then created:

   ------------------------
   [sssd]
   enable_files_domain=true
   services=nss

   [session_recording]
   scope=all
   exclude_users=
   exclude_groups=
   ------------------------

6. After that the IPA/IDM login fails

Actual results:
- The IPA/IDM login fails

Expected results:
- IPA/IDM login should be possible after activating cockpit-session-recording


Root Cause Analysis:
Due to the override for "services" in The file /etc/sssd/conf.d/sssd-session-recording.conf
the IPA/IDM access is disabled.

The default /etc/sssd/sssd.conf file sets the services to
   services = nss, pam, ssh, sudo


Workaround:
Remove the line "services=nss" from /etc/sssd/conf.d/sssd-session-recording.conf
Comment 3 jstephen 2023-04-28 14:49:13 UTC 
Merged upstream https://github.com/Scribery/cockpit-session-recording/commit/86f674bd92f8482fc627027153162bb2bf7bd865