Hide Forgot
Description of problem: In case of Smart Card authentication, the krb5_child of sssd runs as root in order to be able to access the pcscd socket and relies on setting the KRB5CCNAME environment variable to access the ccache on behalf of the user. However, with KCM, root cannot access another user's ccache, see e.g. this explanation by MIT krb5 upstream: https://github.com/krb5/krb5/pull/557#issuecomment-254834623 Therefore we need to obtain the credentials as a user who can talk to pcscd (typically root) but then drop the privileges to the user who is logging and and save the credentials to the ccache as that user. Version-Release number of selected component (if applicable): up to sssd-2.0-24 How reproducible: always Steps to Reproduce: 1. login to an IPA client with a smart card 2. klist 3. Actual results: credential cache KCM:$uid not found Expected results: a valid credential cache Additional info: see e.g. https://bugzilla.redhat.com/show_bug.cgi?id=1441764#c8 or a thread on freeipa-users titled "smartcard auth + kerberos ticket?" from Nov-15 2018.
Upstream ticket: https://pagure.io/SSSD/sssd/issue/3903
* master: e49e9f727e4960c8a0a2ed50488dac6e51ddf284
Hi Scott, can you please qa_ack this bug? You found the original issue in https://bugzilla.redhat.com/show_bug.cgi?id=1441764#c8 so I guess you know how to reproduce.
Verified. Version :: sssd-2.0.0-43.el8.x86_64 sssd-kcm-2.0.0-43.el8.x86_64 Results :: # p11tool --provider /usr/lib64/opensc-pkcs11.so --export 'pkcs11:model=PKCS%2315;manufacturer=Aventra%20Ltd.;serial=7055056447986431;token=singleuser1-01%20%28MyEID%29;id=%01;object=cert.01;type=cert' --outfile /tmp/card.crt # ipa certmap-match /tmp/card.crt --------------- 2 users matched --------------- Domain: EXAMPLE.COM User logins: singleuser1 Domain: ad.test User logins: adcertsingleuser1 ---------------------------- Number of entries returned 2 ---------------------------- # su - singleuser1 -c "kdestroy -A" # su - singleuser1 -c "su - singleuser1 -c klist" PIN for singleuser1-01 (MyEID) Ticket cache: KCM:614800473:39355 Default principal: singleuser1@EXAMPLE.COM Valid starting Expires Service principal 02/11/2019 14:50:28 02/12/2019 14:50:21 krbtgt/EXAMPLE.COM@EXAMPLE.COM