Created attachment 1583187 [details] krb5.conf Description of problem: A RHEL 8.0 system set up for GSSAPI login for ssh allows to log in but does not actually store the ticket. klist shows no ticket after login. NFS4 with kerberos does not mount a home directory as a result. Version-Release number of selected component (if applicable): sssd-kcm-2.0.0-43.el8_0.3.x86_64 openssh-7.8p1-4.el8.x86_64 krb5-workstation-1.16.1-22.el8.x86_64 Additional info: Running sshd in debug mode shows this: debug1: temporarily_use_uid: 50515/103585 (e=0/0) debug3: ssh_krb5_cc_new_unique: called debug3: ssh_krb5_get_cctemplate: called debug3: ssh_krb5_expand_template: called, template = KCM: debug3: ssh_krb5_get_cctemplate: returning with ccname = KCM: debug3: ssh_krb5_cc_new_unique: setting default ccname to KCM: debug3: ssh_krb5_cc_new_unique: calling cc_new_unique(KCM:) debug3: ssh_krb5_cc_new_unique: calling cc_switch() ssh_krb5_cc_new_unique(): End of credential cache reached which seems to indicate an error trying to store the TGT. ssh_config, sshd_config and krb5.conf are attached.
Created attachment 1583188 [details] sshd_config
Created attachment 1583189 [details] ssh_config
Created attachment 1583190 [details] sssd.conf
Update: When using 'KEYRING' as cache the ticket is correctly forwarded. sshd logs the following in this case: ... debug1: temporarily_use_uid: 50515/103585 (e=0/0) debug3: ssh_krb5_cc_new_unique: called debug3: ssh_krb5_get_cctemplate: called debug3: ssh_krb5_expand_template: called, template = KEYRING:persistent:%{uid} debug3: ssh_krb5_get_cctemplate: returning with ccname = KEYRING:persistent:50515 debug3: ssh_krb5_cc_new_unique: setting default ccname to KEYRING:persistent:50515 debug3: ssh_krb5_cc_new_unique: calling cc_new_unique(KEYRING:persistent:50515) debug3: ssh_krb5_cc_new_unique: calling cc_switch() debug1: restore_uid: 0/0 ...
Hello Jakub, Customer feedback. Removing 'ccache_storage = memory' fixes this issue. That works for us so please close this request and the associated bug report unless RH wants to actually fix this also for the memory ccache storage. Thanks, Kushal
Upstream ticket: https://github.com/SSSD/sssd/issues/5333
Pushed PR: https://github.com/SSSD/sssd/pull/5313 * `master` * f126afc98e1e7ae1df685980dd1773e81ae10668 - KCM: Fix GSSAPI delegation for the memory back end
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (sssd bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:1666