RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
Summary: sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only ava...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: sssd
Version: 8.5
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: rc
: ---
Assignee: Alexey Tikhonov
QA Contact: Steeve Goveas
URL:
Whiteboard: sync-to-jira
Depends On:
Blocks: 2030651
TreeView+ depends on / blocked
 
Reported: 2021-12-08 16:06 UTC by Jonathan Billings
Modified: 2022-05-10 16:47 UTC (History)
11 users (show)

Fixed In Version: sssd-2.6.2-3.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2030651 (view as bug list)
Environment:
Last Closed: 2022-05-10 15:26:44 UTC
Type: Bug
Target Upstream Version:
Embargoed:
pm-rhel: mirror+

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-105165 0 None None None 2021-12-08 16:09:19 UTC
Red Hat Issue Tracker SSSD-4157 0 None None None 2021-12-09 11:36:23 UTC
Red Hat Knowledge Base (Solution) 6913881 0 None None None 2022-04-12 19:55:13 UTC
Red Hat Product Errata RHBA-2022:2070 0 None None None 2022-05-10 15:27:03 UTC

Description Jonathan Billings 2021-12-08 16:06:58 UTC 
Description of problem:

When upgrading from RHEL 8.4 to 8.5, if you just update the sssd packages and not the krb5 packages, and you are using the KCM ccache (which is the default for sssd), the sssd-kcm.service fails with this error:

Dec 08 10:47:51 myhost systemd[1]: Starting SSSD Kerberos Cache Manager...
Dec 08 10:47:51 myhost systemd[1]: Started SSSD Kerberos Cache Manager.
Dec 08 10:47:51 myhost sssd_kcm[14809]: /usr/libexec/sssd/sssd_kcm: symbol lookup error: /usr/libexec/sssd/sssd_kcm: undefined symbol: krb5_unmarshal_credentials, version krb5_3_MIT
Dec 08 10:47:51 myhost systemd[1]: sssd-kcm.service: Main process exited, code=exited, status=127/n/a
Dec 08 10:47:51 myhost systemd[1]: sssd-kcm.service: Failed with result 'exit-code'.

You can verify it by running:

# /usr/libexec/sssd/sssd_kcm
/usr/libexec/sssd/sssd_kcm: symbol lookup error: /usr/libexec/sssd/sssd_kcm: undefined symbol: krb5_unmarshal_credentials, version krb5_3_MIT
#

This means that you can't log in using with accounts using sssd-krb5.  In fact, you cannot even kinit, because the default ccache is inaccessible.

# kinit
kinit: Connection reset by peer while getting default ccache


Version-Release number of selected component (if applicable):
sssd-kcm-2.5.2-2.el8_5.1.x86_64
krb5-libs-1.18.2-8.3.el8_4.x86_64


How reproducible:
Always


Steps to Reproduce:
1. Install RHEL 8.5 with the latest sssd (2.5.2-2.el8_5.1)
2. Downgrade the krb5-libs package to the latest 8.4 package (krb5-libs-1.18.2-8.3.el8_4.x86_64)
3. run /usr/libexec/sssd/sssd_kcm

Actual results:
No kerberos-based authentication through sssd succeeds because the location of the Kerberos ccache isn't functional.

Expected results:
The sssd-kcm package should be impossible to install with an older krb5-libs.


Additional info:
The packages for sssd-kcm (and potentially sssd-krb5) need to require the version of krb5-libs that have the "krb5_unmarshal_credentials" symbol.
Comment 4 Alexey Tikhonov 2021-12-08 17:20:52 UTC 
https://github.com/SSSD/sssd/commit/4b7b6fa70399654b8a6d2f691be832c0680ee1fb
Comment 10 Steeve Goveas 2022-01-07 14:22:02 UTC 
[root@ci-vm-10-0-137-242 ~]# rpm -q sssd-kcm krb5-libs
sssd-kcm-2.6.1-2.el8.x86_64
krb5-libs-1.18.2-14.el8.x86_64

[root@ci-vm-10-0-137-242 ~]# yum downgrade krb5-libs

Downgraded:
  krb5-libs-1.18.2-8.el8.x86_64                                                                                                                                                
 
Complete!
 
[root@ci-vm-10-0-137-242 ~]# /usr/libexec/sssd/sssd_kcm
/usr/libexec/sssd/sssd_kcm: symbol lookup error: /usr/libexec/sssd/sssd_kcm: undefined symbol: krb5_unmarshal_credentials, version krb5_3_MIT
 
 
[root@ci-vm-10-0-137-242 ~]# rpm -q sssd-kcm krb5-libs
sssd-kcm-2.6.1-2.el8.x86_64
krb5-libs-1.18.2-8.el8.x86_64
 
[root@ci-vm-10-0-137-242 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux release 8.6 Beta (Ootpa)

Reproduced

[root@ci-vm-10-0-137-242 ~]# /usr/libexec/sssd/sssd_kcm
/usr/libexec/sssd/sssd_kcm: symbol lookup error: /usr/libexec/sssd/sssd_kcm: undefined symbol: krb5_unmarshal_credentials, version krb5_3_MIT
 
[root@ci-vm-10-0-137-242 ~]# vim /etc/yum.repos.d/rhel.repo
 
[root@ci-vm-10-0-137-242 ~]# yum update sssd-kcm
Installed products updated.
 
Upgraded:
  libsss_certmap-2.6.2-2.el8.x86_64   libsss_idmap-2.6.2-2.el8.x86_64   libsss_nss_idmap-2.6.2-2.el8.x86_64   sssd-client-2.6.2-2.el8.x86_64   sssd-common-2.6.2-2.el8.x86_64  
  sssd-kcm-2.6.2-2.el8.x86_64        
 
Complete!
 
[root@ci-vm-10-0-137-242 ~]# rpm -q sssd-kcm krb5-libs
sssd-kcm-2.6.2-2.el8.x86_64
krb5-libs-1.18.2-8.el8.x86_64

Not fixed
 
[root@ci-vm-10-0-137-242 ~]# /usr/libexec/sssd/sssd_kcm
/usr/libexec/sssd/sssd_kcm: symbol lookup error: /usr/libexec/sssd/sssd_kcm: undefined symbol: krb5_unmarshal_credentials, version krb5_3_MIT
 
[root@ci-vm-10-0-137-242 ~]# rpm -q sssd-krb5
package sssd-krb5 is not installed
 
[root@ci-vm-10-0-137-242 ~]# yum install sssd-krb5
Installed products updated.
 
Installed:
  cyrus-sasl-gssapi-2.1.27-5.el8.x86_64                         sssd-krb5-2.6.2-2.el8.x86_64                         sssd-krb5-common-2.6.2-2.el8.x86_64                        
 
Complete!

Not fixed
 
[root@ci-vm-10-0-137-242 ~]# /usr/libexec/sssd/sssd_kcm
/usr/libexec/sssd/sssd_kcm: symbol lookup error: /usr/libexec/sssd/sssd_kcm: undefined symbol: krb5_unmarshal_credentials, version krb5_3_MIT

Marking failedQA
Comment 12 Steeve Goveas 2022-01-20 10:01:05 UTC 
[root@ci-vm-10-0-138-95 ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux release 8.6 Beta (Ootpa)

[root@ci-vm-10-0-138-95 ~]# rpm -q krb5-libs sssd-kcm
krb5-libs-1.18.2-8.el8.x86_64
sssd-kcm-2.6.2-2.el8.x86_64

[root@ci-vm-10-0-138-95 ~]# /usr/libexec/sssd/sssd_kcm
/usr/libexec/sssd/sssd_kcm: symbol lookup error: /usr/libexec/sssd/sssd_kcm: undefined symbol: krb5_unmarshal_credentials, version krb5_3_MIT

[root@ci-vm-10-0-138-95 ~]# yum update sssd-kcm
Updating Subscription Management repositories.
Unable to read consumer identity

This system is not registered with an entitlement server. You can use subscription-manager to register.

rhel-latest                                                                                                                                     545 kB/s |  28 kB     00:00    
rhel-old                                                                                                                                         87 kB/s | 2.8 kB     00:00    
rhel                                                                                                                                            265 kB/s | 2.8 kB     00:00    
rhel-AppStream                                                                                                                                  340 kB/s | 3.2 kB     00:00    
Dependencies resolved.
================================================================================================================================================================================
 Package                                       Architecture                        Version                                       Repository                                Size
================================================================================================================================================================================
Upgrading:
 krb5-libs                                     x86_64                              1.18.2-14.el8                                 rhel                                     840 k            <<--------------------
 libsss_certmap                                x86_64                              2.6.2-3.el8                                   rhel-latest                              163 k
 libsss_idmap                                  x86_64                              2.6.2-3.el8                                   rhel-latest                              122 k
 libsss_nss_idmap                              x86_64                              2.6.2-3.el8                                   rhel-latest                              129 k
 sssd-client                                   x86_64                              2.6.2-3.el8                                   rhel-latest                              225 k
 sssd-common                                   x86_64                              2.6.2-3.el8                                   rhel-latest                              1.6 M
 sssd-kcm                                      x86_64                              2.6.2-3.el8                                   rhel-latest                              251 k            <<--------------------

Transaction Summary
================================================================================================================================================================================
Upgrade  7 Packages

Total download size: 3.3 M
Is this ok [y/N]: y

[root@ci-vm-10-0-138-95 ~]# /usr/libexec/sssd/sssd_kcm
[root@ci-vm-10-0-138-95 ~]# echo $?
2

verified with
[root@ci-vm-10-0-138-95 ~]# rpm -q krb5-libs sssd-kcm
krb5-libs-1.18.2-14.el8.x86_64
sssd-kcm-2.6.2-3.el8.x86_64
Comment 19 errata-xmlrpc 2022-05-10 15:26:44 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sssd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2070
Note You need to log in before you can comment on or make changes to this bug.