Description of problem: Default of 'pac_check' is too strict, it currently requires that a PAC is present when using ipa or ad provider. While it would work with the AD provider in most cases for ipa there is a fair chance that the PAC will not be available. If authentication fails and there are messages like "[validate_tgt] ... PAC check failed for principal ..." you are most probably affected by this issue. As a work-around set pac_check = check_upn, check_upn_dns_info_ex in the [pac] section of sssd.conf.
*** Bug 2094648 has been marked as a duplicate of this bug. ***
Upstream pull-request with a fix https://github.com/SSSD/sssd/pull/6204.
*** Bug 2095086 has been marked as a duplicate of this bug. ***
*** Bug 2095102 has been marked as a duplicate of this bug. ***
*** Bug 2094948 has been marked as a duplicate of this bug. ***
*** Bug 2095176 has been marked as a duplicate of this bug. ***
Pushed PR: https://github.com/SSSD/sssd/pull/6204 * `master` * 55e93cf1cf4d61c6de7975cbdc97a723545586c0 - pac: relax default for pac_check option * `sssd-2-7` * 26d8601e9b4e35ff89ca9fa72b9db05199096b56 - pac: relax default for pac_check option
FEDORA-2022-1f115ce8d2 has been submitted as an update to Fedora 35. https://bodhi.fedoraproject.org/updates/FEDORA-2022-1f115ce8d2
FEDORA-2022-6d9be7e4c4 has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2022-6d9be7e4c4
I'd like to commend the rapid response here. Has upstream added a regression test to ensure this doesn't happen again?
*** Bug 2095228 has been marked as a duplicate of this bug. ***
FEDORA-2022-6d9be7e4c4 has been pushed to the Fedora 36 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2022-6d9be7e4c4` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-6d9be7e4c4 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2022-1f115ce8d2 has been pushed to the Fedora 35 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2022-1f115ce8d2` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-1f115ce8d2 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
*** Bug 2095356 has been marked as a duplicate of this bug. ***
FEDORA-2022-6d9be7e4c4 has been pushed to the Fedora 36 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2022-1f115ce8d2 has been pushed to the Fedora 35 stable repository. If problem still persists, please make note of it in this bug report.