Bug 1837405
| Summary: | Multiples Kerberos ticket on RHEL after lock and unlock screen | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Alexey Tikhonov <atikhono> |
| Component: | sssd | Assignee: | Sumit Bose <sbose> |
| Status: | CLOSED ERRATA | QA Contact: | sssd-qe <sssd-qe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.2 | CC: | grajaiya, jhrozek, lslebodn, mniranja, mzidek, pbrezina, sgoveas, thalman, tscherf |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | sync-to-jira | ||
| Fixed In Version: | sssd-2.3.0-1.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-04 02:05:17 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Versions:
=========
Red Hat Enterprise Linux release 8.3 Beta (Ootpa)
sssd-krb5-2.3.0-7.el8.x86_64
python3-sssdconfig-2.3.0-7.el8.noarch
sssd-ipa-2.3.0-7.el8.x86_64
sssd-tools-2.3.0-7.el8.x86_64
sssd-kcm-2.3.0-7.el8.x86_64
sssd-proxy-2.3.0-7.el8.x86_64
sssd-debuginfo-2.2.0-19.el8.x86_64
sssd-dbus-2.3.0-7.el8.x86_64
sssd-common-pac-2.3.0-7.el8.x86_64
sssd-krb5-common-2.3.0-7.el8.x86_64
sssd-tools-debuginfo-2.2.0-19.el8.x86_64
sssd-client-2.3.0-7.el8.x86_64
sssd-common-2.3.0-7.el8.x86_64
sssd-nfs-idmap-2.2.0-16.el8.x86_64
sssd-ad-2.3.0-7.el8.x86_64
sssd-ldap-2.3.0-7.el8.x86_64
sssd-2.3.0-7.el8.x86_64
sssd.conf
[sssd]
config_file_version = 2
services = nss, pam
domains = example1
[domain/example1]
ldap_search_base = dc=example,dc=test
id_provider = ldap
auth_provider = krb5
ldap_uri = ldaps://ds-server.testrealm.test
ldap_tls_cacert = /etc/openldap/cacerts/cacert.pem
use_fully_qualified_names = False
debug_level = 9
ldap_sasl_mech = GSSAPI
krb5_realm = EXAMPLE.TEST
krb5_server = ds-server.testrealm.test
cache_credentials = True
offline_credentials_expiration = 0
Check /etc/krb5.conf has krb5 credential cache to FILE
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
ticket_lifetime = 24h
default_realm = EXAMPLE.TEST
dns_lookup_realm = false
dns_lookup_kdc = false
forwardable = true
rdns = false
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
spake_preauth_groups = edwards25519
default_ccache_name = FILE:/tmp/krb5cc_%{uid}
[realms]
EXAMPLE.TEST = {
kdc = ds-server.testrealm.test
admin_server = ds-server.testrealm.test
}
[domain_realm]
example.test = EXAMPLE.TEST
.example.test = EXAMPLE.TEST
[appdefaults]
validate = true
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf
[root@ds-server ~]# getent passwd -s sss foo0
foo0:*:14583100:14564100:foo0 User:/home/foo0:/bin/bash
Login as foo0 user using graphical login
[root@ds-server ~]# ls -l /tmp/krb5cc_*
-rw-------. 1 root root 703 Aug 12 17:28 /tmp/krb5cc_0
-rw-------. 1 foo0 ldapusers 514 Aug 17 12:22 /tmp/krb5cc_14583100
Lock the screen and unlock .
[root@ds-server ~]# ls -l /tmp/krb5cc_*
-rw-------. 1 root root 703 Aug 12 17:28 /tmp/krb5cc_0
-rw-------. 1 foo0 ldapusers 514 Aug 17 12:22 /tmp/krb5cc_14583100
After locking and unlocking multiple times, there was no additional credential cache files apart
from what is shown above.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (sssd bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:4569 |
* `master` * 11435b1060675339263ce0a2a546cc44ab9bd576 - krb5: do not cache ccache or password during preauth * `sssd-1-16` * 895aa34af41cc76aaac78c3cb74c68eeeb31a1d9 - krb5: do not cache ccache or password during preauth