Bug 2168417 - AD accounts that have passwords with excessive length (126+ characters) breaks smart card authentication
Summary: AD accounts that have passwords with excessive length (126+ characters) break...
Keywords:
Status: CLOSED INSUFFICIENT_DATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: sssd
Version: 8.7
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: Sumit Bose
QA Contact: sssd-qe
URL:
Whiteboard: sync-to-jira
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-02-08 23:39 UTC by Chance Callahan
Modified: 2023-05-29 18:42 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-05-25 13:59:39 UTC
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-148067 0 None None None 2023-02-08 23:41:07 UTC
Red Hat Issue Tracker SSSD-6125 0 None None None 2023-05-23 07:26:27 UTC

Description Chance Callahan 2023-02-08 23:39:43 UTC
Description of problem:

If an AD account has a password exceeding 126 characters, it is unable to log in using a smart card.

Version-Release number of selected component (if applicable):

sssd-2.7.3-4.el8_7.3.x86_64

How reproducible:

Customer is able to reproduce it, I am having trouble though configuring a repro in the lab.

Steps to Reproduce:
1. Configured AD to use smart card logins and an associated RHEL machine.
2. Create AD account with a password in excess of 126 chracters.
3. Try logging in with a smart card on RHEL.

Actual results:

Login fails.

Expected results:

Login succeeds.

Additional info:

Comment 1 Sumit Bose 2023-02-09 07:00:57 UTC
Hi,

as long as you cannot reproduce it, would it be possible to ask the customer for SSSD logs with 'debug_level = 9' in the [pam] and [domain/...] sections covering a failed login attempt?

bye,
Sumit


Note You need to log in before you can comment on or make changes to this bug.