Description of problem:
Cloned from https://pagure.io/SSSD/sssd/issue/3420
An IPA enrolled client, configured with kcdproxy in /etc/krb5.conf and having the following entries in /etc/sssd/sssd.conf:
cache_credentials = True
krb5_store_password_if_offline = True
As long as the host is online when logging in, everything works as expected. And the logged in user have a valid kerberos ticket instantly.
But if the host is offline (wlan disabled, no ethernet), the cached credentials are not considered for the authentication and the authentication fails. The gdm interface says "Authentication failed".
Disable the kdcproxy in /etc/krb5.conf, and logging in works when being offline. Drawback is that there will be no kerberos ticket available until the host is connected to a network or VPN which enables access to the IPA/KDC server.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Change /etc/krb5.conf to use proxy
2. Go Offine
3. Try to authenticate
4. Fail to authenticate
Offline Authentication should also work if the KdcProxy functionality is used.