RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1918433 - sssd unable to lookup certmap rules
Summary: sssd unable to lookup certmap rules
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: sssd
Version: 8.4
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Sumit Bose
QA Contact: Scott Poore
URL:
Whiteboard: sync-to-jira review
: 1918429 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-01-20 17:20 UTC by Scott Poore
Modified: 2021-05-18 15:04 UTC (History)
7 users (show)

Fixed In Version: sssd-2.4.0-7.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-05-18 15:04:21 UTC
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 5469 0 None closed sssd unable to lookup certmap rules 2021-01-29 16:21:25 UTC

Description Scott Poore 2021-01-20 17:20:04 UTC
Description of problem:

SSSD seems to be unable to lookup certmap rules as least after resetting the cache:

Here it works:

# date; su - ipauser1 -c 'su - ipauser1 -c whoami'
Tue Jan 19 12:23:41 EST 2021
PIN for smime:
ipauser1

But, after a reset:

# systemctl stop sssd; rm -rf /var/lib/sss/{db,mc}/*; systemctl start sssd

# date; su - ipauser1 -c 'su - ipauser1 -c whoami'
Tue Jan 19 12:28:08 EST 2021
Password:
Session terminated, killing shell... ...killed.

If I restart sssd again it works:

# systemctl restart sssd

# date; su - ipauser1 -c 'su - ipauser1 -c whoami'
Tue Jan 19 12:30:01 EST 2021
PIN for smime:
Session terminated, killing shell... ...killed.


and in the logs I see:

(2021-01-19 12:28:05): [pam] [sss_certmap_init] (0x0040): sss_certmap initialized.
(2021-01-19 12:28:05): [pam] [sysdb_get_certmap] (0x0400): No certificate maps found.
...
(2021-01-19 12:29:59): [pam] [sss_certmap_init] (0x0040): sss_certmap initialized.
(2021-01-19 12:29:59): [pam] [p11_refresh_certmap_ctx] (0x4000): Trying to add rule [maprule_0][-1][SUER>CN=CA,O=My Test][(|(userCertificate;binary={cert!bin})(ipacertmapdata=X509:{issuer_dn!nss_x500}
{subject_dn!nss_x500}) )].

Version-Release number of selected component (if applicable):
sssd-2.4.0-6.el8.x86_64

How reproducible:
Unknown but, happened in testing a few times almost predictably.

Steps to Reproduce:
1.  Setup IPA Smart Card Authentication 
(may work with sssd files provider and local certmap rules in sssd.conf but, I'm not sure)
2.  Setup certmap rules and data to map certificate on card to user
3.  Reset sssd cache and attempt authentication

Actual results:

Fails after reset but, if you do an "systemctl restart sssd" after failure, it seems to be able to read them again.  

Also, in sssd_pam.log I don't see the certmap rules listed after the cache reset.

Expected results:

Reads certmap rules after cache reset without issues.

Additional info:

Comment 1 Sumit Bose 2021-01-20 17:24:28 UTC
Upstream ticket:
https://github.com/SSSD/sssd/issues/5469

Comment 2 Scott Poore 2021-01-20 17:28:11 UTC
*** Bug 1918429 has been marked as a duplicate of this bug. ***

Comment 3 Pavel Březina 2021-01-25 10:31:58 UTC
Pushed PR: https://github.com/SSSD/sssd/pull/5470

* `master`
    * cb936e92041d63f79a74c30bae8140c74a18dbc0 - pam: refresh certificate maps at the end of initial domains lookup
    * e07eeea7df55ede36ac0978ac904c1bb11188265 - responders: add callback to schedule_get_domains_task()

Comment 7 Scott Poore 2021-01-29 22:59:50 UTC
Verified.

Version ::

sssd-client-2.4.0-7.el8.x86_64

Results ::

Since this is a race condition bug, I ran a subset of regression tests multiple times.

I also ran a quick loop attempting to reproduce the scenario:

# for i in {1..10}; do
> systemctl stop sssd; rm -rf /var/lib/sss/{db,mc}/*; systemctl start sssd
> expect -f /tmp/su_test.exp
> done
spawn su - ipauser1 -c su - ipauser1 -c "echo success > /tmp/ipa_sc_test.d/SGFFOTGRHB.output"
PIN for ipauser1: 
spawn su - ipauser1 -c su - ipauser1 -c "echo success > /tmp/ipa_sc_test.d/SGFFOTGRHB.output"
PIN for ipauser1: 
spawn su - ipauser1 -c su - ipauser1 -c "echo success > /tmp/ipa_sc_test.d/SGFFOTGRHB.output"
PIN for ipauser1: 
spawn su - ipauser1 -c su - ipauser1 -c "echo success > /tmp/ipa_sc_test.d/SGFFOTGRHB.output"
PIN for ipauser1: 
spawn su - ipauser1 -c su - ipauser1 -c "echo success > /tmp/ipa_sc_test.d/SGFFOTGRHB.output"
PIN for ipauser1: 
spawn su - ipauser1 -c su - ipauser1 -c "echo success > /tmp/ipa_sc_test.d/SGFFOTGRHB.output"
PIN for ipauser1: 
spawn su - ipauser1 -c su - ipauser1 -c "echo success > /tmp/ipa_sc_test.d/SGFFOTGRHB.output"
PIN for ipauser1: 
spawn su - ipauser1 -c su - ipauser1 -c "echo success > /tmp/ipa_sc_test.d/SGFFOTGRHB.output"
PIN for ipauser1: 
spawn su - ipauser1 -c su - ipauser1 -c "echo success > /tmp/ipa_sc_test.d/SGFFOTGRHB.output"
PIN for ipauser1: 
spawn su - ipauser1 -c su - ipauser1 -c "echo success > /tmp/ipa_sc_test.d/SGFFOTGRHB.output"
PIN for ipauser1: 


# cat /tmp/su_test.exp 
set timeout 20
set send_slow {1 .1}
spawn su - ipauser1 -c "su - ipauser1 -c \"echo success > /tmp/ipa_sc_test.d/SGFFOTGRHB.output\""
expect {
  "PIN for*" {
    send -- "redhat\r"
  }
  "Please select a certificate by typing the corresponding number*" {
    send -- "1\r"
    exp_continue
  }
}
expect eof

Comment 9 errata-xmlrpc 2021-05-18 15:04:21 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sssd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:1666


Note You need to log in before you can comment on or make changes to this bug.