Problem with keytab renewal, breaking authentication when sssd is joined to an AD domain

[Camilo Vargas]

When using sssd to join to an AD domain without adcli installed there is a problem with keytab renewal, breaking authentication in some scenarios.

Workaround:
apt-get install adcli

Workaround found in:
http://thread.gmane.org/gmane.linux.redhat.sssd.user/4065

Related bugs:
https://fedorahosted.org/sssd/ticket/3017
https://fedorahosted.org/sssd/ticket/3016

Relevant /var/log/sssd/sssd_AD.ACTIVARSAS.CO.log
------------------------------------------------
(Wed Jun 8 09:38:25 2016) [sssd[be[AD.ACTIVARSAS.CO]]] [ad_machine_account_password_renewal_timeout] (0x0020): Timeout reached for AD renewal child.
(Wed Jun 8 09:38:25 2016) [sssd[be[AD.ACTIVARSAS.CO]]] [be_ptask_done] (0x0040): Task [AD machine account password renewal]: failed with [1432158266]: AD renewal child failed
(Wed Jun 8 09:38:25 2016) [sssd[be[AD.ACTIVARSAS.CO]]] [child_sig_handler] (0x0020): child [2533] was terminated by signal [9].
------------------------------------------------

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: sssd 1.13.4-1ubuntu1
ProcVersionSignature: Ubuntu 4.4.0-22.40-generic 4.4.8
Uname: Linux 4.4.0-22-generic x86_64
ApportVersion: 2.20.1-0ubuntu2.1
Architecture: amd64
CurrentDesktop: Unity
Date: Wed Jun 8 09:53:41 2016
InstallationDate: Installed on 2016-06-07 (0 days ago)
InstallationMedia: Ubuntu 16.04 LTS "Xenial Xerus" - Release amd64 (20160420.1)
JournalErrors:
 Error: command ['journalctl', '-b', '--priority=warning', '--lines=1000'] failed with exit code 1: Hint: You are currently not seeing messages from other users and the system.
       Users in the 'systemd-journal' group can see all messages. Pass -q to
       turn off this notice.
 No journal files were opened due to insufficient permissions.
ProcEnviron:
 LANGUAGE=es_CO:es
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=es_CO.UTF-8
 SHELL=/bin/bash
SourcePackage: sssd
UpgradeStatus: No upgrade log present (probably fresh install)

[Robie Basak (racb)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. I don't see this in Debian sssd packaging either. This should be sent up to Debian for consideration to add a Depends or Recommends on adcli.

[Timo Aaltonen (tjaalton)]

I'm the maintainer on both Debian and Ubuntu, and am not convinced it should depend on adcli. The related bugs should get fixed, though.

[Jakub Hrozek (jakub-hrozek)]

The bugs were fixed some time ago, you can just cherry-pick the patches from the stable sssd-1-13 branch.

[Joel Cesar Zamboni (joel.zamboni)]

Hi Timo,

I can tell for sure that this bug happen, we had 40+ workstations running Ubuntu and a workaround of restarting the SSSD daemon every 5 minutes(cron) just to keep it working. When I saw the article on the Fedora team and installed the adcli it just worked.

 Initially I opened the bug on the documentation side, because I understood it will be easier to fix the documents then the code/package. Please, can you return the bug to the documentation team so at least people won't get stucked?

Regards,

Joel Zamboni

[Doug Smythies (dsmythies)]

@Joel: We will not change the Ubuntu serverguide with respect to this problem. The problem itself should be fixed.

Do not set this back (it was originally the duplicate, actually) to the serverguide project.

[Launchpad Janitor (janitor)]

This bug was fixed in the package sssd - 1.15.0-3ubuntu1

---------------
sssd (1.15.0-3ubuntu1) zesty; urgency=medium

  * Build without the secrets service as libhttp-parser2.1 is in universe. An
    MIR is pending in LP 1638957; when this is complete, we can revert this.
    - Configure with --without-secrets.
    - Drop build depends on libhttp-parser-dev and libjansson-dev. These are
      only needed for the "secrets service".
    - Remove secrets service -related files from d/sssd-common.install and in
      d/rules.

 -- Robie Basak <email address hidden> Tue, 07 Feb 2017 19:37:45 +0000

[Robie Basak (racb)]

This isn't quite resolved for Ubuntu. I didn't realise when I first responded to this bug that adcli was in universe. So we have a component mismatch between sssd-ad and adcli at the moment.

[Robie Basak (racb)]

So if I understand this report correctly, the problem was that there was a problem with keytab renewal, breaking authentication in some scenarios, and that installing adcli "fixed" it. However, this was a bug, and installing adcli shouldn't have been necessary. Installing adcli was really a workaround, and we believe this is fixed properly now.

So, Timo has demoted adcli to Suggests in Debian (https://anonscm.debian.org/cgit/pkg-sssd/sssd.git/commit/?id=d26fd6b8d6dfe9cb3d74c0caa8566bfc3fc7b977). I'll upload the same thing in Ubuntu shortly to fix the component mismatch.

So "add adcli as sssd dependency" was inadvertently presupposing the solution, we have fixed the root cause, and so we won't be adding adcli as an sssd dependency after all. But this bug is fixed, because sssd should work correctly without adcli installed again, so I'm marking this bug Fix Released.

If any of this is wrong, please do correct me. I'll stay subscribed to the bug.

[Robie Basak (racb)]

So I think the original problem was fixed in sssd_1.15.0-3ubuntu1, and I've fixed the component mismatch by dropping adcli down to a Suggests in sssd_1.15.0-3ubuntu2.