Description of problem: Using SSSD AD and a UPN username login (i.e where the UPN name doesn't equal the domain name) succeeds correctly when connected to the network. However the user in unable to login when offline. Cached credentials aren't working. Version-Release number of selected component (if applicable): sssd-1.11.0-0.1.beta2.fc19.x86_64 How reproducible: Everytime Steps to Reproduce: 1.Login whilst connected to the network 2.Logout 3.Disconnect network cable 4.Attempt to login when off the network Actual results: Unable to login off the network Expected results: Login succeeds off the network Additional info: I can't guarantee this is due to UPN logins, but I'm guessing due to presumably cached credentials working for users on simpler domains. I have no way of testing this. My very un-sssd expert eyes seem to indicate that sssd is losing the username (lots of name "(unknown)" appearing) somewhere in the process. (Mon Aug 26 19:08:08 2013) [sssd[nss]] [check_cache] (0x0400): Cached entry is valid, returning.. (Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_initgroups_search] (0x0400): Initgroups for [colin] completed (Mon Aug 26 19:08:08 2013) [sssd[nss]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7f08383b83d0][20]ion (Mon Aug 26 19:08:08 2013) [sssd[nss]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7f08383b83d0][20] (Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [17] with input [(unknown)]. (Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name '(unknown)' matched without domain, user is (unknown) (Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)] (Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [(unknown)] from [<ALL>] (Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/USER/iongeo.lan/(unknown)] (Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0400): User [(unknown)] does not exist in [iongeo.lan]! (negative cache) (Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0080): No matching domain found for [(unknown)], fail! (Mon Aug 26 19:08:08 2013) [sssd[nss]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7f08383b83d0][20] (Mon Aug 26 19:08:08 2013) [sssd[nss]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x7f08383b83d0][20] (Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [17] with input [(unknown)]. (Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name '(unknown)' matched without domain, user is (unknown) (Mon Aug 26 19:08:08 2013) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)] (Mon Aug 26 19:08:08 2013) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [(unknown)] from [<ALL>]
Created attachment 790691 [details] sssd.conf
Can you attach the full logs of a successful and a failed attempt?
(In reply to Sumit Bose from comment #2) > Can you attach the full logs of a successful and a failed attempt? Sent privately.
Thank you for the logs. they are very helpful. You are right, it is related to the UPNs you are using. The UPNs are not the "real" Kerberos principals but an alias which gets canonicalized by the AD KDC. SSSD stores the canonicalized version after a successful authentication but, since we store it in the same attribute as the UPN read from AD it gets overwritten. In the offline case we end up with the alias UPN which we cannot map back to the canonicalized version, which is used e.g. in the credential cache. To fix this the canonical UPN should be saved in a separate attribute in the cache and used when needed and available.
Upstream ticket: https://fedorahosted.org/sssd/ticket/2060
Fixed upstream.
sssd-1.11.1-1.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/sssd-1.11.1-1.fc19
Package sssd-1.11.1-1.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing sssd-1.11.1-1.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-17879/sssd-1.11.1-1.fc19 then log in and leave karma (feedback).
sssd-1.11.1-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.