Bug 1445821
| Summary: | sssd does not evaluate AD UPN suffixes which results in failed user logins | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Jaroslav Reznik <jreznik> |
| Component: | sssd | Assignee: | SSSD Maintainers <sssd-maint> |
| Status: | CLOSED ERRATA | QA Contact: | Sudhir Menon <sumenon> |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 7.3 | CC: | grajaiya, jhrozek, kludhwan, ksiddiqu, lslebodn, markus.larsson, mkosek, mzidek, pbrezina, ronald.wimmer, sbose, sgoveas, sssd-maint, tscherf |
| Target Milestone: | rc | Keywords: | ZStream |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | sssd-1.14.0-43.el7_3.15 | Doc Type: | If docs needed, set a value |
| Doc Text: |
In environments with a trust relationship between Identity Management (IdM) and Active Directory (AD), AD users with an alternative user principal name (UPN) configured were unable to log in. With this update, AD users with an alternative UPN can log in as expected.
|
Story Points: | --- |
| Clone Of: | 1441077 | Environment: | |
| Last Closed: | 2017-06-28 17:00:01 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1441077 | ||
| Bug Blocks: | |||
|
Description
Jaroslav Reznik
2017-04-26 15:05:15 UTC
Upstream ticket: https://pagure.io/SSSD/sssd/issue/3384 [root@ipamaster ~]# ipa trust-find --------------- 1 trust matched --------------- Realm name: pne.qe Domain NetBIOS name: PNE Domain Security Identifier: S-1-5-21-2202318585-426110948-4011710778 Trust type: Active Directory domain UPN suffixes: test.qa, pune.in ---------------------------- Number of entries returned 1 ---------------------------- Do you see any related messages in krb5kdc.log on the IPA server? Did you try to restart kdb5kdc on the IPA server to force to reload the UPN suffixes? Tested on RHEL7.3.z using ipa-server-4.4.0-14.el7_3.7.x86_64 sssd-1.14.0-43.el7_3.18.x86_64 samba-4.4.4-13.el7_3.x86_64 selinux-policy-3.13.1-102.el7_3.16.noarch krb5-server-1.14.1-27.el7_3.x86_64 389-ds-base-1.3.5.10-21.el7_3.x86_64 pki-server-10.3.3-18.el7_3.noarch After restarting krb5kdc service, i am able to login using trusted user having UPN set. [root@ipamaster ~]# systemctl restart krb5kdc.service [root@ipamaster ~]# ipa trust-find --------------- 1 trust matched --------------- Realm name: pne.qe Domain NetBIOS name: PNE Domain Security Identifier: S-1-5-21-2202318585-426110948-4011710778 Trust type: Active Directory domain UPN suffixes: test.qa, pune.in ---------------------------- Number of entries returned 1 ---------------------------- [root@mgmt6 ~]# id aduser2 uid=1261601539(aduser2) gid=1261601539(aduser2) groups=1261601539(aduser2),1261601629(adgroup2),1261601559(adgroup1),1261600513(domain users) [root@mgmt6 ~]# id aduser2 uid=1261601539(aduser2) gid=1261601539(aduser2) groups=1261601539(aduser2),1261601629(adgroup2),1261601559(adgroup1),1261600513(domain users) [root@mgmt6 ~]# ssh -l aduser2 ipamaster.rhel73.test Password: Last failed login: Fri Jun 2 07:03:09 EDT 2017 from 2620:52:0:1007:250:45ff:fe5f:413d on ssh:notty There were 13 failed login attempts since the last successful login. Could not chdir to home directory /home/pne.qe/aduser2: No such file or directory -sh-4.2$ id uid=1261601539(aduser2) gid=1261601539(aduser2) groups=1261601539(aduser2),1261600513(domain users),1261601559(adgroup1),1261601629(adgroup2) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:1605 |