Description of problem:
Password expiry notifications to AD clients with SSSD no longer work due to regression from fix for bug 1385665.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1) Configure sssd to use auth_provider=krb5 or ad.
2) Configure short password expiry for user in AD.
No expiry message is sent to any client e.g. gnome, ssh etc.
Expiry message should be seen.
My first suggestion would be to not use the private version of krb5_get_init_creds_password() even if it means regressing the other bug.
Looking at how libkrb5 implements the password expiration, we'd need to inspect the AS reply and the only API that libkrb5 publicly makes available that returns struct krb5_kdc_rep is marked as deprecated. So reimplementing the functionality looks non-trivial. But moreover, I'm worried that we would be constantly missing some fixes or changes to the recommended krb5_get_init_creds_password..
To capture the discussion we had last week on our team meeting:
- we would ask MIT to provide an API to access the needed data
- in the meantime, we could suggest using auth_provider=krb5. This should have no functional regression compared with auth_provider=ad as long as the following two options are set:
- krb5_validate = true
- krb5_use_enterprise_principal = true
it looks like a new API is not strictly needed.
Robbie, can you have a look at https://github.com/sumit-bose/krb5/commit/036888a75c875f4ab4b850967bec47ab421bc276 and let me know if the change makes sense and would be worth for a pull-request.
Hi Sumit, I've reviewed it and it looks reasonable to me. I think we should propose it (I assume you want to do this, but I'm willing to handle it if that's easier).
My understanding is that that change by itself will fix the SSSD issue; is that right? If so, it seems like we should move this bug to krb5.
(In reply to Robbie Harwood from comment #6)
> Hi Sumit, I've reviewed it and it looks reasonable to me. I think we should
> propose it (I assume you want to do this, but I'm willing to handle it if
> that's easier).
thanks for the feedback. I updated the description of krb5_get_init_creds_opt_set_expire_callback() in krb5.hin in the latest version in https://github.com/sumit-bose/krb5/commits/warn_pw_expiry. It looks like the preferred way to contribute is a pull-request on github, I will create one.
> My understanding is that that change by itself will fix the SSSD issue; is
> that right? If so, it seems like we should move this bug to krb5.
Yes, with the modified libkrb5 SSSD can receive the password expiration data automatically again, no changes needed on the SSSD side.
I created https://github.com/krb5/krb5/pull/1056 and as suggested by Robbie in comment #6 I move this ticket to krb5. If the pull-request is not accepted please move the ticket back to SSSD so that we can think about alternative solutions.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (krb5 bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.