Bug 1001310 - Cached credentials aren't working with sssd-ad UPN logins
Cached credentials aren't working with sssd-ad UPN logins
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: sssd (Show other bugs)
19
Unspecified Linux
unspecified Severity medium
: ---
: ---
Assigned To: Jakub Hrozek
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-08-26 17:02 EDT by Colin.Simpson
Modified: 2013-09-30 22:16 EDT (History)
8 users (show)

See Also:
Fixed In Version: sssd-1.11.1-1.fc19
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-09-30 22:16:23 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
sssd.conf (473 bytes, text/plain)
2013-08-26 17:03 EDT, Colin.Simpson
no flags Details

  None (edit)
Description Colin.Simpson 2013-08-26 17:02:28 EDT
Description of problem:

Using SSSD AD and a UPN username login (i.e where the UPN name doesn't equal the domain name) succeeds correctly when connected to the network. However the user in unable to login when offline. Cached credentials aren't working.

Version-Release number of selected component (if applicable):
sssd-1.11.0-0.1.beta2.fc19.x86_64

How reproducible:
Everytime

Steps to Reproduce:
1.Login whilst connected to the network
2.Logout
3.Disconnect network cable
4.Attempt to login when off the network

Actual results:
Unable to login off the network

Expected results:
Login succeeds off the network

Additional info:

I can't guarantee this is due to UPN logins, but I'm guessing due to presumably cached credentials working for users on simpler domains. I have no way of testing this.

My very un-sssd expert eyes seem to indicate that sssd is losing the username (lots of name "(unknown)" appearing) somewhere in the process.

(Mon Aug 26 19:08:08 2013) [sssd[nss]] [check_cache] (0x0400): Cached entry is valid, returning..
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_initgroups_search] (0x0400): Initgroups for [colin@iongeo.lan] completed
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7f08383b83d0][20]ion
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7f08383b83d0][20]
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [17] with input [(unknown)].
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name '(unknown)' matched without domain, user is (unknown)
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)]
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [(unknown)] from [<ALL>]
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/USER/iongeo.lan/(unknown)]
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0400): User [(unknown)] does not exist in [iongeo.lan]! (negative cache)
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0080): No matching domain found for [(unknown)], fail!
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7f08383b83d0][20]
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7f08383b83d0][20]
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [17] with input [(unknown)].
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name '(unknown)' matched without domain, user is (unknown)
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)]
(Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [(unknown)] from [<ALL>]
Comment 1 Colin.Simpson 2013-08-26 17:03:45 EDT
Created attachment 790691 [details]
sssd.conf
Comment 2 Sumit Bose 2013-08-27 04:01:30 EDT
Can you attach the full logs of a successful and a failed attempt?
Comment 3 Jakub Hrozek 2013-08-27 04:42:02 EDT
(In reply to Sumit Bose from comment #2)
> Can you attach the full logs of a successful and a failed attempt?

Sent privately.
Comment 4 Sumit Bose 2013-08-27 06:27:09 EDT
Thank you for the logs. they are very helpful.

You are right, it is related to the UPNs you are using. The UPNs are not the "real" Kerberos principals but an alias which gets canonicalized by the AD KDC. SSSD stores the canonicalized version after a successful authentication but, since we store it in the same attribute as the UPN read from AD it gets overwritten.

In the offline case we end up with the alias UPN which we cannot map back to the canonicalized version, which is used e.g. in the credential cache.

To fix this the canonical UPN should be saved in a separate attribute in the cache and used when needed and available.
Comment 5 Jakub Hrozek 2013-08-27 07:07:58 EDT
Upstream ticket:
https://fedorahosted.org/sssd/ticket/2060
Comment 6 Jakub Hrozek 2013-09-23 11:04:44 EDT
Fixed upstream.
Comment 7 Fedora Update System 2013-09-27 17:09:48 EDT
sssd-1.11.1-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/sssd-1.11.1-1.fc19
Comment 8 Fedora Update System 2013-09-28 21:27:06 EDT
Package sssd-1.11.1-1.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing sssd-1.11.1-1.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-17879/sssd-1.11.1-1.fc19
then log in and leave karma (feedback).
Comment 9 Fedora Update System 2013-09-30 22:16:23 EDT
sssd-1.11.1-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.