Bug 2481235

Summary:	Password for trusted user not available when sssd backend is offline
Product:	[Fedora] Fedora	Reporter:	Kanwar Ranbir Sandhu <m3freak>
Component:	sssd	Assignee:	sssd-maintainers <sssd-maintainers>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	44	CC:	abokovoy, atikhono, lslebodn, pbrezina, sbose, ssorce, sssd-maintainers
Target Milestone:	---	Keywords:	Regression
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-05-26 07:55:54 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Kanwar Ranbir Sandhu 2026-05-25 16:05:29 UTC

I'm running a Fedora 44 desktop that was upgraded (in-place) from Fedora 43. The desktop is enrolled into an AlmaLinux 9 IdM domain that is in a trust with AD. Trusted users can login when sssd is connected to IdM. When the connection to IdM is unavailable (e.g. the VPN drops), new logins with trusted user account are denied and existing trusted user logins can't use sudo (denied).

Offline logins or sudo use with trusted users has worked flawlessly for many releases. It also worked after the upgrade to Fedora 44. The current issue began less than a month ago.

I have no changes on the IdM domain side (or in AD, that I know of).

Offline login attemps fail immediately (there is zero delay). If I try offline sudo usage, it fails immediately after I enter the password, but the password prompt takes a few seconds to appear.

User lookup while offline does work (i.e. id trustedUser or sssctl user-checks trustedUser.tld).

Reproducible: Always

Steps to Reproduce:
1. Connect to VPN
2. Login with trusted user into GNOME or via ssh
3. Use sudo with any command
4. Disconnect the VPN
5. Try new login to GNOME or via ssh
6. Try sudo with any command
Actual Results:
Immediate login fail or sudo use denied.

Expected Results:
Offline login or sudo use allowed, with some initial delay because sssd has to determine the backend is offline and switches to using the cached credentials.

Additional Information:
ranbir@pc:~$ ssh trustedUseru.domain.tld
(trustedUser.domain.tld) Password:
Connection closed by 1.2.3.4 port 22

Interesting log from the journal for sshd:
sshd-session[99030]: error: PAM: User account has expired for [[removed username]]

Comment 1 Alexey Tikhonov 2026-05-25 16:35:04 UTC

Could you please review bz 2466974 and bz 2464782 to see if this is a duplicate?

Comment 2 Kanwar Ranbir Sandhu 2026-05-25 17:39:25 UTC

(In reply to Alexey Tikhonov from comment #1)
> Could you please review bz 2466974 and bz 2464782 to see if this is a
> duplicate?

Yes, those sound exactly like what I'm experiencing and what I described here.

This one can be marked as a duplicate.

Comment 3 Alexey Tikhonov 2026-05-26 07:55:54 UTC


*** This bug has been marked as a duplicate of bug 2466974 ***