RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1287807 - SRV lookup for KDC servers doesn't work
Summary: SRV lookup for KDC servers doesn't work
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: sssd
Version: 6.7
Hardware: x86_64
OS: Linux
unspecified
low
Target Milestone: rc
: ---
Assignee: Petr Čech
QA Contact: Namita Soman
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-12-02 17:56 UTC by Brian Nelson
Modified: 2020-05-02 18:14 UTC (History)
9 users (show)

Fixed In Version: sssd-1.13.3-5.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-05-10 20:25:29 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 3929 0 None closed SRV lookups with id_provider=proxy and auth_provider=krb5 2020-05-22 19:04:47 UTC
Red Hat Product Errata RHBA-2016:0782 0 normal SHIPPED_LIVE sssd bug fix and enhancement update 2016-05-10 22:36:00 UTC

Description Brian Nelson 2015-12-02 17:56:48 UTC 
Description of problem:

Service discovery for KDC servers in sssd doesn't work. SSSD no longer attempts to lookup SRV records and issues the debug message "No SRV lookup plugin is set".

It worked properly in RHEL 6.5, broken in RHEL 6.6 through current. May be related to fix for Bug 1122873 (just a guess).


Version-Release number of selected component (if applicable):

sssd-1.9.2-129.el6_5.4.x86_64 WORKS OK (6.5)

sssd-1.11.6-30.el6.x86_64 DOES NOT WORK (6.6)

sssd-1.12.4-47.el6_7.4.x86_64 DOES NOT WORK (current)


How reproducible:
Always


Steps to Reproduce:
1. Configure sssd w/krb5 auth
2. Do NOT set krb5_server, or set to '_srv_'

Actual results:
No SRV lookup is done. Kerberos goes offline. Auth doesn't work.

Expected results:

An SRV lookup should be done and those servers used for Kerberos auth.

Additional info:
Debug messages:

(Wed Dec  2 12:43:35 2015) [sssd[be[krb_admin]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'KERBEROS'
(Wed Dec  2 12:43:35 2015) [sssd[be[krb_admin]]] [resolve_srv_send] (0x0040): No SRV lookup plugin is set
(Wed Dec  2 12:43:35 2015) [sssd[be[krb_admin]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks.
Comment 2 Brian Nelson 2015-12-02 18:12:40 UTC 
In addition, even using something like this:

krb5_server = _srv_,fqdn.of.kdc

Doesn't work AT ALL. It doesn't even fail over to the specified server. The SRV problem causes kerberos to go offline completely.
Comment 3 Jakub Hrozek 2015-12-02 20:39:04 UTC 
Upstream ticket:
https://fedorahosted.org/sssd/ticket/2888
Comment 4 Jakub Hrozek 2015-12-09 15:48:45 UTC 
Assigning BZ to the same owner as the ticket..
Comment 6 Jakub Hrozek 2016-01-14 17:33:47 UTC 
Fixed upstream:
    master: 684191e61d891b1c34f3742a40d5a2ed6a1192dd
    sssd-1-13: dd5a52db9653d83bef26da468157c216df45f715
Comment 8 Dan Lavu 2016-03-21 14:58:00 UTC 
Verified against sssd-client-1.13.3-19.el6.x86_64, SRV records resolve fine. 



#### Config 
[sssd]
config_file_version = 2
services = nss, pam
domains = domain.com

[nss]
default_shell = /bin/bash

[domain/domain.com]
debug_level = 9
id_provider = ad
ad_domain = domain.com
auth_provider = krb5
krb5_server = _srv_
krb5_realm = DOMAIN.COM

cache_credentials = True
krb5_store_password_if_offline = True
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
ad_gpo_access_control = permissive
access_provider = ad



#### Logs
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [remove_connection_callback] (0x4000): Successfully removed connection callback.
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [ad_get_client_site_done] (0x0040): Unable to retrieve site name [2]: No such file or directory
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [ad_srv_plugin_site_done] (0x0400): About to discover primary and backup servers
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [fo_discover_servers_send] (0x0400): Looking up primary servers
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [resolv_discover_srv_next_domain] (0x0400): SRV resolution of service 'KERBEROS'. Will use DNS discovery domain 'domain.com'
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_KERBEROS._udp.domain.com'
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 6 seconds
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [resolv_getsrv_done] (0x1000): Using TTL [600]
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [request_watch_destructor] (0x0400): Deleting request watch
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [fo_discover_srv_done] (0x0400): Got answer. Processing...
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [fo_discover_srv_done] (0x0400): Got 2 servers
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [fo_discover_servers_primary_done] (0x0400): No backup domain specified
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [ad_srv_plugin_servers_done] (0x0400): Got 2 primary and 0 backup servers
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [fo_add_server_to_list] (0x0400): Inserted primary server 'ad2.domain.com:88' to service 'KERBEROS'
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [fo_add_server_to_list] (0x0400): Inserted primary server 'ad1.domain.com:88' to service 'KERBEROS'
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [set_srv_data_status] (0x0100): Marking SRV lookup of service 'KERBEROS' as 'resolved'
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [get_server_status] (0x1000): Status of server 'ad2.domain.com' is 'name not resolved'
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [resolv_is_address] (0x4000): [ad2.domain.com] does not look like an IP address
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [resolv_gethostbyname_step] (0x2000): Querying files
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record of 'ad2.domain.com' in files
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [set_server_common_status] (0x0100): Marking server 'ad2.domain.com' as 'resolving name'
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [resolv_gethostbyname_step] (0x2000): Querying files
Comment 10 errata-xmlrpc 2016-05-10 20:25:29 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-0782.html
Note You need to log in before you can comment on or make changes to this bug.