Bug 1287807 - SRV lookup for KDC servers doesn't work
SRV lookup for KDC servers doesn't work
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: sssd (Show other bugs)
6.7
x86_64 Linux
unspecified Severity low
: rc
: ---
Assigned To: Petr Čech
Namita Soman
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-12-02 12:56 EST by Brian Nelson
Modified: 2016-05-10 16:25 EDT (History)
9 users (show)

See Also:
Fixed In Version: sssd-1.13.3-5.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-05-10 16:25:29 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Brian Nelson 2015-12-02 12:56:48 EST
Description of problem:

Service discovery for KDC servers in sssd doesn't work. SSSD no longer attempts to lookup SRV records and issues the debug message "No SRV lookup plugin is set".

It worked properly in RHEL 6.5, broken in RHEL 6.6 through current. May be related to fix for Bug 1122873 (just a guess).


Version-Release number of selected component (if applicable):

sssd-1.9.2-129.el6_5.4.x86_64 WORKS OK (6.5)

sssd-1.11.6-30.el6.x86_64 DOES NOT WORK (6.6)

sssd-1.12.4-47.el6_7.4.x86_64 DOES NOT WORK (current)


How reproducible:
Always


Steps to Reproduce:
1. Configure sssd w/krb5 auth
2. Do NOT set krb5_server, or set to '_srv_'

Actual results:
No SRV lookup is done. Kerberos goes offline. Auth doesn't work.

Expected results:

An SRV lookup should be done and those servers used for Kerberos auth.

Additional info:
Debug messages:

(Wed Dec  2 12:43:35 2015) [sssd[be[krb_admin]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'KERBEROS'
(Wed Dec  2 12:43:35 2015) [sssd[be[krb_admin]]] [resolve_srv_send] (0x0040): No SRV lookup plugin is set
(Wed Dec  2 12:43:35 2015) [sssd[be[krb_admin]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks.
Comment 2 Brian Nelson 2015-12-02 13:12:40 EST
In addition, even using something like this:

krb5_server = _srv_,fqdn.of.kdc

Doesn't work AT ALL. It doesn't even fail over to the specified server. The SRV problem causes kerberos to go offline completely.
Comment 3 Jakub Hrozek 2015-12-02 15:39:04 EST
Upstream ticket:
https://fedorahosted.org/sssd/ticket/2888
Comment 4 Jakub Hrozek 2015-12-09 10:48:45 EST
Assigning BZ to the same owner as the ticket..
Comment 6 Jakub Hrozek 2016-01-14 12:33:47 EST
Fixed upstream:
    master: 684191e61d891b1c34f3742a40d5a2ed6a1192dd
    sssd-1-13: dd5a52db9653d83bef26da468157c216df45f715
Comment 8 Dan Lavu 2016-03-21 10:58:00 EDT
Verified against sssd-client-1.13.3-19.el6.x86_64, SRV records resolve fine. 



#### Config 
[sssd]
config_file_version = 2
services = nss, pam
domains = domain.com

[nss]
default_shell = /bin/bash

[domain/domain.com]
debug_level = 9
id_provider = ad
ad_domain = domain.com
auth_provider = krb5
krb5_server = _srv_
krb5_realm = DOMAIN.COM

cache_credentials = True
krb5_store_password_if_offline = True
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
ad_gpo_access_control = permissive
access_provider = ad



#### Logs
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [remove_connection_callback] (0x4000): Successfully removed connection callback.
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [ad_get_client_site_done] (0x0040): Unable to retrieve site name [2]: No such file or directory
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [ad_srv_plugin_site_done] (0x0400): About to discover primary and backup servers
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [fo_discover_servers_send] (0x0400): Looking up primary servers
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [resolv_discover_srv_next_domain] (0x0400): SRV resolution of service 'KERBEROS'. Will use DNS discovery domain 'domain.com'
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_KERBEROS._udp.domain.com'
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 6 seconds
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [resolv_getsrv_done] (0x1000): Using TTL [600]
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [request_watch_destructor] (0x0400): Deleting request watch
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [fo_discover_srv_done] (0x0400): Got answer. Processing...
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [fo_discover_srv_done] (0x0400): Got 2 servers
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [fo_discover_servers_primary_done] (0x0400): No backup domain specified
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [ad_srv_plugin_servers_done] (0x0400): Got 2 primary and 0 backup servers
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [fo_add_server_to_list] (0x0400): Inserted primary server 'ad2.domain.com:88' to service 'KERBEROS'
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [fo_add_server_to_list] (0x0400): Inserted primary server 'ad1.domain.com:88' to service 'KERBEROS'
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [set_srv_data_status] (0x0100): Marking SRV lookup of service 'KERBEROS' as 'resolved'
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [get_server_status] (0x1000): Status of server 'ad2.domain.com' is 'name not resolved'
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [resolv_is_address] (0x4000): [ad2.domain.com] does not look like an IP address
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [resolv_gethostbyname_step] (0x2000): Querying files
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record of 'ad2.domain.com' in files
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [set_server_common_status] (0x0100): Marking server 'ad2.domain.com' as 'resolving name'
(Mon Mar 21 10:55:44 2016) [sssd[be[domain.com]]] [resolv_gethostbyname_step] (0x2000): Querying files
Comment 10 errata-xmlrpc 2016-05-10 16:25:29 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-0782.html

Note You need to log in before you can comment on or make changes to this bug.