missing includedir snippet in krb5.conf causes GSSAPI to fail

[Fabian]

sssd is missing a vital line in /etc/krb5.conf
includedir /var/lib/sss/pubconf/krb5.include.d

Without this passwordless login using GSSAPI via SSH is not possible to a Ubuntu 22.04 machine.
The solution was found here: https://github.com/PowerShell/Win32-OpenSSH/issues/1875
It was fixed for rpm distributions here https://github.com/SSSD/sssd/issues/5893 but apparently never made it into Ubuntu.

This is on Ubuntu 22.04.2 LTS with sssd 2.6.3-1ubuntu3.2

[Lucas Kanashiro (lucaskanashiro)]

Thanks for taking the time to report this bug and trying to make Ubuntu better.

I'll be forwarding this issue to Sergio who has been taking care of sssd for a further assessment.

[Koen Dierckx (dierckxk)]

Can confirm this issue. So +1 upvote

[Mario Chisari (mumon66)]

Can confirm too. It was hard to find the solution, so I hope this will avoid people banging head on the table.

[Paride Legovini (paride)]

I discussed this with the team; ahasenack suggests that we should add that include line to src:kerberos-configs, which is the package that provides krb5.conf.

[Andreas Hasenack (ahasenack)]

There are two components here:
a) sssd to ship /etc/krb5.conf.d/enable_sssd_conf_dir
This was done in 2.7.0-1, and is present in ubuntu mantic and later

b) krb5.conf to includedir /etc/krb5.conf.d
This should be done in src:kerberos-configs, and is not done yet anywhere

[Andreas Hasenack (ahasenack)]

> Without this passwordless login using GSSAPI via SSH is not possible to a Ubuntu 22.04 machine.

This is not entirely true. We have tests that attempt this login and they pass just fine. There is some other detail that is missing. I'll read up in more detail on what the sssd_krb5_localauth_plugin.so plugin does. The upstream bug also had in one of the comments confirmation that a ~/.k5login file with the name of the principal would allow login to work, which tells me some sort of mapping between the username of the ssh command (which can have @DOMAIN components) and the local username is missing, and that plugin might be responsible for it.

[Andreas Hasenack (ahasenack)]

Confirmed the issue on jammy, and the fix, by joining a machine to a windows AD domain, and attempting to login via ssh GSSAPIAuthentication as a domain user. It only works if I either put the principal name in ~/.k5login, or include the sssd localauth plugin via the include files as discussed in this bug.