SSSD / sssd

#304 SSSD should play better with krb5-auth-dialog
Closed: Fixed Opened by sgallagh.

Closed: Fixed
Reopen Issue

When we perform an offline authentication, we generate an empty credential cache. Instead, we should generate a set of fake credentials whose creation and expiration time are equal (They do not need to have a valid key in this case).

The reason is that krb5-auth-dialog uses the TGT to determine the correct credential to prompt for updates to. It does not respect the "default principal". Furthermore, it treats a ccache containing no credentials as equivalent to not having a ccache and will exit immediately (in its default configuration). If you pass the -A (always) argument to it, it will start, but it will be unable to identify the proper principal (leading to it using username@example.com if the krb5.conf is in its default state).

I'm recommending this as a 11 feature at this time.

Fields changed

cc: => dwalsh, nalin

Fixed by b2016c8921421849b67c156b701f0c4ca23b55d6

fixedin: => 1.0.0
resolution: => fixed
status: new => closed

I'm not exactly sure of the use case or how to verify it is fixed. Can we be more specific?

This cannot be automated as far as I know.

Pre-requisite: install krb5-auth-dialog on the system.

Log in via GDM while offline with a user not currently on the system (to ensure new credential cache).

krb5-auth-dialog should notify you that your credentials are expired.

Before this fix, krb5-auth-dialog would not recognize that you were a kerberos user, and would not track your credentials.

Fields changed

rhbz: => 0

Metadata Update from @sgallagh:
- Issue assigned to sbose
- Issue set to the milestone: SSSD 1.1

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1346

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
Normal
defect
Kerberos Provider
0.99.0
dwalsh, nalin
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.