One of the objectives in the design of sssd is that for the common case /etc/krb5.conf is not needed, but all config information are given in sssd.conf. To allow regular tools like kinit, kpasswd etc to find a KDC without consulting /etc/krb5.conf the locator plugin /usr/lib{64}/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so returns the IP address of the KDC sssd is currently talking to.

Besides the config option krb5_server there is also krb5_kpasswd where you can specify a different server (or admin server) where kpasswdd is running. This should solve the issue you are seeing.

The krb5_kpasswd option was set properly to the name of the host running kadmind on the hosts where I tested this.

Although, on second thought, this might be related to the other bug I filed where the IP of that server had changed within the past few days; it's possible that sssd simply hadn't done a fresh DNS lookup.

In any case, because of these issues I've just gone through and restarted sssd everywhere so hopefully I won't run into any of these issues until I have to move the servers again.

We think that this issues is related to the ticket #809 that already addresses the problem. We will setup the test case and make sure that the scenario works. If it does not, we will open another ticket.

resolution: => fixed
status: new => closed

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.5.2

Fields changed

rhbz: => 0

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1855

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.