Red Hat Bugzilla – Bug 1168735
The Kerberos provider is not properly views-aware
Last modified: 2015-03-05 05:34:33 EST
Description of problem: The Kerberos provider does not handle views properly. This can result in strange behaviour, like the ccache being created with the original UID instead of the overriden one. Version-Release number of selected component (if applicable): sssd-1.12.2-28.el7 How reproducible: always Steps to Reproduce: 1. Assign an UID override on the server side 2. Log in to the client. Run "id" to make sure the ID is as expected 3. run klist Actual results: An error message, complaining that ccache is not present in the keyring for the specified UID Expected results: The ccache should be printed correctly. Additional info:
Upstream ticket: https://fedorahosted.org/sssd/ticket/2510
Fixed in master: * b7088215501c99e40ae71d1c57e0b789bbae2c87 * 2bf1cbffaac3b4bc0bd736493c985ca865092805 * 61d2ccf1dae3f1e7fc987ae98cb5c493cc73a782
Verified in version [root@sideswipe ~]# rpm -q sssd ipa-server sssd-1.12.2-52.el7.x86_64 ipa-server-4.1.0-17.el7.x86_64 On Server [root@sideswipe ~]# ipa idoverrideuser-add 'default trust view' aduser1@adtest.qe --uid 1672600010 ------------------------------------------ Added User ID override "aduser1@adtest.qe" ------------------------------------------ Anchor to override: aduser1@adtest.qe UID: 1672600010 [root@sideswipe ~]# service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start On Client [root@ratchet ~]# service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start [root@ratchet ~]# ssh -l aduser1@adtest.qe `hostname` "id;klist" aduser1@adtest.qe@ratchet.ipabugs.test's password: Could not chdir to home directory /home/adtest.qe/aduser1: Permission denied uid=1672600010(aduser1@adtest.qe) gid=1148401313(aduser1@adtest.qe) groups=1148401313(aduser1@adtest.qe),1148400513(domain users@adtest.qe),1148401449(adgroup1@adtest.qe),1148402424(adunigroup1@adtest.qe),1148402425(adgroup2@adtest.qe),1672600004(sudogroup) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Ticket cache: KEYRING:persistent:1672600010:krb_ccache_QCg9JGw Default principal: aduser1@ADTEST.QE Valid starting Expires Service principal 01/28/2015 19:43:32 01/29/2015 05:43:32 krbtgt/ADTEST.QE@ADTEST.QE renew until 01/29/2015 19:43:32
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0441.html