Bug 2095228 - sssd_krb5 2.7.1 crashes "PAC check failed"
Summary: sssd_krb5 2.7.1 crashes "PAC check failed"
Keywords:
Status: CLOSED DUPLICATE of bug 2094685
Alias: None
Product: Fedora
Classification: Fedora
Component: sssd
Version: 36
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: sssd-maintainers
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-06-09 10:47 UTC by seanmottles
Modified: 2022-06-09 10:54 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2022-06-09 10:54:24 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)
sssd krb5 log file (7.92 KB, text/plain)
2022-06-09 10:47 UTC, seanmottles 		no flags Details
View All

Description seanmottles 2022-06-09 10:47:29 UTC 
Created attachment 1888304 [details]
sssd krb5 log file

Description of problem:
Attempting to authenticate via password on Fedora 36 host connected to FreeIPA with sssd 2.7.1-1 fails. ID lookups still function as normal.


Version-Release number of selected component (if applicable):
sssd-2.7.1-1.fc36

How reproducible:
Every attempt.

Steps to Reproduce:
1. Connect host to FreeIPA
2. Attempt to auth FreeIPA user via password
3.

Actual results:
"System Error" in /var/log/secure, and "PAC check failed for principal" in /var/log/sssd/krb5_child.log


Expected results:
Password auth is functional

Additional info:
Downgrading sssd to 2.7.0 resolves the issue and users can login as normal.
Comment 1 Iker Pedrosa 2022-06-09 10:54:24 UTC 
As a work-around set

    pac_check = check_upn, check_upn_dns_info_ex

in the [pac] section of sssd.conf.

*** This bug has been marked as a duplicate of bug 2094685 ***
Note You need to log in before you can comment on or make changes to this bug.