Bug 1698558 - KdcProxy + offline caching does not wok in offline mode
Summary: KdcProxy + offline caching does not wok in offline mode
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: sssd
Version: 8.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: 8.2
Assignee: SSSD Maintainers
QA Contact: sssd-qe
Depends On:
TreeView+ depends on / blocked
Reported: 2019-04-10 15:30 UTC by Luc de Louw
Modified: 2019-05-09 15:12 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed:
Type: Bug
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Fedora Pagure SSSD/sssd issue 3420 None None None 2019-04-10 15:45:12 UTC

Description Luc de Louw 2019-04-10 15:30:30 UTC
Description of problem:

Cloned from https://pagure.io/SSSD/sssd/issue/3420

An IPA enrolled client, configured with kcdproxy in /etc/krb5.conf and having the following entries in /etc/sssd/sssd.conf:

cache_credentials = True
krb5_store_password_if_offline = True

As long as the host is online when logging in, everything works as expected. And the logged in user have a valid kerberos ticket instantly.

But if the host is offline (wlan disabled, no ethernet), the cached credentials are not considered for the authentication and the authentication fails. The gdm interface says "Authentication failed".

Disable the kdcproxy in /etc/krb5.conf, and logging in works when being offline. Drawback is that there will be no kerberos ticket available until the host is connected to a network or VPN which enables access to the IPA/KDC server.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Change /etc/krb5.conf to use proxy
2. Go Offine
3. Try to authenticate
4. Fail to authenticate

Actual results:

Expected results:
Offline Authentication should also work if the KdcProxy functionality is used.

Additional info:

Comment 2 Jakub Hrozek 2019-05-09 15:12:07 UTC
Upstream ticket:

Note You need to log in before you can comment on or make changes to this bug.