Bug 590134 - sssd: auth_provider = proxy regression
sssd: auth_provider = proxy regression
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: sssd (Show other bugs)
6.0
All Linux
low Severity medium
: rc
: ---
Assigned To: Stephen Gallagher
Chandrasekar Kannan
:
Depends On:
Blocks: 579775
  Show dependency treegraph
 
Reported: 2010-05-07 15:41 EDT by Jack Neely
Modified: 2015-01-04 18:42 EST (History)
5 users (show)

See Also:
Fixed In Version: sssd-1.2.0-12.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-11-10 16:39:35 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jack Neely 2010-05-07 15:41:30 EDT
Description of problem:

Using SSSD in my PAM stack, I've found that when I set auth_provider = proxy and reference a new PAM configuration (proxy_pam_target = ncsu-proxy) that new PAM stack doesn;t work at all. 

I've confirmed this with sgallagh in #freeipa and his testing shows that the pam_proxy_target doesn't work for any library.  They all return "User not known to the underlying authentication module"

In my case I'm using the ncsu-proxy config which looks like this:

auth        required      pam_krb5.so 
password    required      pam_krb5.so use_authtok
session     optional      pam_krb5.so

With SSSD running this config I get errors:

May  7 15:26:47 kvmguest02 sssd_be: pam_krb5[2023]: error resolving user name 'jjneely' to uid/gid pair
May  7 15:26:47 kvmguest02 sssd_be: pam_krb5[2023]: error getting information about 'jjneely'
May  7 15:26:47 kvmguest02 sshd[2027]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=foo.bar user=jjneely
May  7 15:26:47 kvmguest02 sshd[2027]: pam_sss(sshd:auth): received for user jjneely: 10 (User not known to the underlying authentication module)

Of course, getent passwd jjneely returns correct results (also provided by SSSD)

My workaround for the time being is to simply replace pam_sss in my PAM stack with pam_krb5.

Version-Release number of selected component (if applicable):
sssd-1.0.2-1.el6.i686
Comment 3 RHEL Product and Program Management 2010-05-07 17:12:06 EDT
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.
Comment 6 Gowrishankar Rajaiyan 2010-07-28 09:29:58 EDT
/etc/pam.d/nscu-proxy 
auth        required      pam_krb5.so 
password    required      pam_krb5.so use_authtok
session     optional      pam_krb5.so

From the logs:
Jul 28 19:00:51 gsr64bit proxy_child: pam_krb5[29113]: authentication succeeds for 'puser1' (puser1@EXAMPLE.COM)

Verified with the above "pam_proxy_target".
Version: sssd-1.2.1-21.el6.
Comment 7 releng-rhel@redhat.com 2010-11-10 16:39:35 EST
Red Hat Enterprise Linux 6.0 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.

Note You need to log in before you can comment on or make changes to this bug.