Bug 2379224

Summary:	'realm' doesn't support rotation of machine account password by sssd-ad
Product:	[Fedora] Fedora	Reporter:	Luca Cavana <luca.cavana>
Component:	realmd	Assignee:	Sumit Bose <sbose>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	42	CC:	abokovoy, atikhono, lslebodn, luca.cavana, luk.claes, pbrezina, sbose, ssorce, sssd-maintainers, stefw
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	realmd-0.17.1-17.fc42	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-07-12 01:46:10 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Luca Cavana 2025-07-10 08:28:02 UTC

Description of problem:
In a Fedora 42 machine joined to AD DS by sssd and realmd (Windows Server 2022 DCs with Server 2016 Functional Level), sssd fails to rotate the machine account password, as dictated by:
ad_maximum_machine_account_password_age = 30 days (default configuration)
ad_machine_account_password_renewal_opts = 86400:750:300:realm (default configuration)

Version-Release number of selected component (if applicable):
sssd-ad.x86_64                          2.11.0-1.fc42
realmd.x86_64                           0.17.1-15.fc42

How reproducible:
Always

Steps to Reproduce:
1. Install a Fedora 42 host, patch it and join to AD DS domain
2. Wait for the default 30 days of time to pass, or modify ad_maximum_machine_account_password_age to shorter value
3. Monitor PasswordLastSet/msDS-KeyVersionNumber attributes in AD DS, they never change

Actual results:
The password is never rotated.

Expected results:
The password is rotated.

Additional info:
In sssd_domain_name.log you can see sssd trying to rotate the password by calling realm command and failing. Here is a snippet of my log:

   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [ad_machine_account_password_renewal_done] (0x1000): --- adcli output start---
 realm discover -v [realm-name]
   Discover available realm

 realm join -v [-U user] realm-name
   Enroll this machine in a realm

 realm leave -v [-U user] [realm-name]
   Unenroll this machine from a realm

 realm list
   List known realms

 realm permit [-ax] [-R realm] user ...
   Permit user logins

 realm deny --all [-R realm]
   Deny user logins
---adcli output end---
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [be_ptask_done] (0x0400): Task [AD machine account password renewal]: finished successfully
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [be_ptask_schedule] (0x0400): Task [AD machine account password renewal]: scheduling task 60 seconds from last execution time [1752134253]
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [child_sig_handler] (0x1000): Waiting for child [86188].
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [child_sig_handler] (0x0020): child [86188] failed with status [2].
********************** BACKTRACE DUMP ENDS HERE *********************************

(2025-07-10  9:57:33): [be[corp.cavanasystems.com]] [child_sig_handler] (0x0020): child [86192] failed with status [2].
   *  ... skipping repetitive backtrace ...
(2025-07-10  9:58:33): [be[corp.cavanasystems.com]] [child_sig_handler] (0x0020): child [86205] failed with status [2].
   *  ... skipping repetitive backtrace ...
(2025-07-10  9:59:33): [be[corp.cavanasystems.com]] [child_sig_handler] (0x0020): child [86211] failed with status [2].
   *  ... skipping repetitive backtrace ...
(2025-07-10 10:00:33): [be[corp.cavanasystems.com]] [child_sig_handler] (0x0020): child [86218] failed with status [2].
   *  ... skipping repetitive backtrace ...

You can see it is calling the realm command to do the rotation but the latter is returning like it is being called with the wrong parameters.
It is then retrying every minute because I've altered my configuration as such, for debugging purposes:
ad_maximum_machine_account_password_age = 30
ad_machine_account_password_renewal_opts = 60:5

Comment 1 Alexey Tikhonov 2025-07-10 09:55:20 UTC

> You can see it is calling the realm command to do the rotation but the latter is returning like it is being called with the wrong parameters.

Does log capture arguments 'realm' is being called with (maybe above "ad_machine_account_password_renewal_done")?
What version of 'realmd' package do you have?

Comment 2 Alexey Tikhonov 2025-07-10 09:58:26 UTC

For this to work properly 'realmd' should have https://gitlab.freedesktop.org/realmd/realmd/-/merge_requests/57/commits

Comment 3 Sumit Bose 2025-07-10 11:02:56 UTC

Hi,

so far I only added the 'renew' option to the rawhide/F43 packages. I will create an update for F42 as well.

bye,
Sumit

Comment 4 Fedora Update System 2025-07-10 12:23:18 UTC

FEDORA-2025-761e7d3a45 (Add 'renew' option) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-761e7d3a45

Comment 5 Fedora Update System 2025-07-10 16:02:18 UTC

FEDORA-2025-761e7d3a45 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-761e7d3a45`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-761e7d3a45

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Luca Cavana 2025-07-11 03:58:35 UTC

Hi,

the fix is working. Thank you!

Comment 7 Sumit Bose 2025-07-11 07:07:18 UTC

Hi,

thanks for the feedback and for giving Karma.

bye,
Sumit

Comment 8 Fedora Update System 2025-07-12 01:46:10 UTC

FEDORA-2025-761e7d3a45 (Add 'renew' option) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.