Created attachment 478603 [details]
sssd_default.log

Description of problem:


Version-Release number of selected component (if applicable):
sssd-1.5.1-5.el6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Login as puser1

-bash-4.1$ klist 
Ticket cache: FILE:/tmp/krb5_cache/krb5cc_puser1
Default principal: puser1

Valid starting     Expires            Service principal
02/14/11 15:45:51  02/14/11 15:47:51  krbtgt/EXAMPLE.COM
	renew until 02/14/11 15:50:51

2. and check for "[renew_all_tgts] (9): Checking [FILE:/tmp/krb5_cache/krb5cc_puser1] for renewal at [Mon Feb 14 15:46:51 2011]."
3. Stop KDC
4. and in the logs ... "[renew_handler] (7): Offline, adding renewal task to online callbacks."
5. Now start KDC and restart SSSD. (make sure to start both of them well within "renew until" time)
  
Actual results:
checking for renewing the tgt does not resume during startup.

Expected results:
Should read the renewable ccache at startup.

Additional info:
KDC setup:
kadmin.local:  getprinc krbtgt/EXAMPLE.COM
Principal: krbtgt/EXAMPLE.COM
Expiration date: [never]
Last password change: [never]
Password expiration date: [none]
Maximum ticket life: 0 days 00:02:00
Maximum renewable life: 0 days 00:05:00
Last modified: Mon Feb 14 04:17:42 EST 2011 (root/admin)
Last successful authentication: [never]
Last failed authentication: [never]
Failed password attempts: 0
Number of keys: 7
Key: vno 1, AES-256 CTS mode with 96-bit SHA-1 HMAC, no salt
Key: vno 1, AES-128 CTS mode with 96-bit SHA-1 HMAC, no salt
Key: vno 1, Triple DES cbc mode with HMAC/sha1, no salt
Key: vno 1, ArcFour with HMAC/md5, no salt
Key: vno 1, DES with HMAC/sha1, no salt
Key: vno 1, DES cbc mode with RSA-MD5, no salt
Key: vno 1, DES cbc mode with CRC-32, no salt
MKey: vno 1
Attributes:
Policy: [none]

kadmin.local:  getprinc puser1
Principal: puser1
Expiration date: [never]
Last password change: Mon Feb 14 01:07:17 EST 2011
Password expiration date: [none]
Maximum ticket life: 0 days 00:02:00
Maximum renewable life: 0 days 00:05:00
Last modified: Mon Feb 14 04:17:49 EST 2011 (root/admin)
Last successful authentication: [never]
Last failed authentication: [never]
Failed password attempts: 0
Number of keys: 8
Key: vno 26, AES-256 CTS mode with 96-bit SHA-1 HMAC, no salt
Key: vno 26, AES-128 CTS mode with 96-bit SHA-1 HMAC, no salt
Key: vno 26, Triple DES cbc mode with HMAC/sha1, no salt
Key: vno 26, ArcFour with HMAC/md5, no salt
Key: vno 26, DES with HMAC/sha1, no salt
Key: vno 26, DES cbc mode with RSA-MD5, no salt
Key: vno 26, DES cbc mode with CRC-32, Version 4
Key: vno 26, DES cbc mode with CRC-32, AFS version 3
MKey: vno 1
Attributes:
Policy: [none]


Relevant SSSD section:
[domain/default]
id_provider = ldap
ldap_uri = ldaps://sssdldap.idm.lab.bos.redhat.com:636
ldap_search_base = dc=example,dc=com
ldap_tls_reqcert = demand
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_cacert = /etc/openldap/cacerts/cacert.asc
cache_credentials = false
enumerate = false
debug_level = 9

auth_provider = krb5
krb5_kdcip = sssdldap.idm.lab.bos.redhat.com
krb5_realm = EXAMPLE.COM
chpass_provider = krb5
krb5_ccachedir = /tmp/krb5_cache
krb5_ccname_template = FILE:%d/krb5cc_%u

krb5_renewable_lifetime = 5m
krb5_lifetime = 120s
krb5_renew_interval = 10s