Bug 2354031

Summary:	Incorrect Kerberos cache type in pam_winbind
Product:	[Fedora] Fedora	Reporter:	Luca Cavana <luca.cavana>
Component:	realmd	Assignee:	Sumit Bose <sbose>
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	41	CC:	luca.cavana, luk.claes, sbose, stefw
Target Milestone:	---	Keywords:	Bugfix, EasyFix
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Luca Cavana 2025-03-21 08:44:43 UTC

When a Fedora 41 or RHEL 9.5 system is joined to an Active Directory domain by using Winbind, realmd configures the pam_winbind library with a cache type = FILE instead of KCM.

Reproducible: Always

Steps to Reproduce:
1. Install a clean Fedora 41 or RHEL 9.5 system.
2. Configure hostname, DNS and chronyd correctly so you can join a domain
3. Install the required components to perform the domain join operation:

sudo dnf install \
realmd oddjob oddjob-mkhomedir samba-winbind-clients samba-winbind samba-common-tools samba-winbind-krb5-locator krb5-workstation

4. Join the system to the domain:

realm join --membership-software=samba --client-software=winbind --user=user domain.com

5. Reboot the system and verify you have a Kerberos ticket by running

klist

Actual Results:
The list of tickets returned by klist is empty.

Expected Results:
You have Kerberos Tickets.

The pam_winbind module is configured incorrectly by realmd with the line

krb5_ccache_type = FILE

in /etc/security/pam_winbind.conf file.

The Kerberos library will search for a Kerberos cache in SSSD-KCM by default both on RHEL 9.x and Fedora 40+ as specified in the /etc/krb5.conf.d/kcm_default_ccache file.

Simply modifying the /etc/security/pam_winbind.conf file with

krb5_ccache_type = KCM

fixes the issue, and then you are able to use the Winbind PAM modules cached tickets by using the system Kerberos library.
SSSD-KCM is installed by default and waits for a socket connection, no further configuration is required to have a working system.