Red Hat Bugzilla – Bug 714600
ipa-client-install should configure sssd to store password if offline
Last modified: 2015-01-04 18:49:29 EST
Description of problem: A common use case is when a user logs in while offline, then goes online (e.g., after establishing a VPN connection) and then tries to access IPA hosts/services. This fails currently because no Kerberos ticket is available after an offline login. It would be nice if ipa-client-install would configure (at least optionally) SSSD to store password if offline (i.e., set krb5_store_password_if_offline in sssd.conf for the domain). Version-Release number of selected component (if applicable): RHEL 6.1
https://fedorahosted.org/freeipa/ticket/1359
master: 1c5028c17df9dc903a6db2712738670c3534246f
Installed client using command: ipa-client-install --domain=testrelm --realm=TESTRELM -p admin -w <xxx> sssd.conf has krb5_store_password_if_offline = True Verified request above using steps below:: 1. Logged in as user test 2. kdestroy - no cached cred. 3. Client's network is stopped 4. log out user test 5. log back user test 6. And user test can log in offline 7. klist shows: Ticket cache: FILE:/tmp/krb5cc_618800003_nNXtCe Default principal: one@TESTRELM Valid starting Expires Service principal 12/31/69 19:00:00 12/31/69 19:00:00 krbtgt/TESTRELM@TESTRELM 8. Restarted network service 9. After a few minutes, klist shows: Ticket cache: FILE:/tmp/krb5cc_618800003_nNXtCe Default principal: one@TESTRELM Valid starting Expires Service principal 10/14/11 15:11:10 10/15/11 15:11:10 krbtgt/TESTRELM@TESTRELM 10. Can ssh as this user to master, without being prompted to reenter password. Verified using ipa-client-2.1.2-2.el6.x86_64
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Cause: The default sssd configuration does not store passwords if offline. Consequence: If the machine is disconnected from the network sssd will be unable to authenticate users. Fix: Set krb5_store_password_if_offline to True in sssd.conf by default. There is an ipa-client-install option --no-krb5-offline-passwords if this is not desired. Result: Passwords are stored by default.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2011-1533.html