Password expiration in AD with SSSD

[Paweł Szafer]

Hi,
I want to warn users when password expiration days are less than 14 days.

I have GPO Default domain policy with this number of days.
I have sssd.conf as:

[sssd]
domains = internal.domain.tld
config_file_version = 2
services = nss, pam

[domain/internal.domain.tld]
cache_credentials = True
debug_level = 6
id_provider = ad
auth_provider = ad
access_provider = ad

default_shell = /bin/bash
fallback_homedir = /home/%d/%u
ldap_id_mapping = True
ldap_schema = ad
enumerate = True
ad_site=internal1

ad_gpo_access_control = permissive

ad_gpo_ignore_unreadable = True

And pam.d as follow:

#%PAM-1.0

auth      sufficient pam_sss.so forward_pass
auth      required   pam_unix.so     try_first_pass nullok
auth      optional    pam_permit.so
auth      required    pam_env.so
#auth      requisite    pam_deny.so

account   required    pam_unix.so
account   [default=bad success=ok user_unknown=ignore]  pam_sss.so
account   optional    pam_permit.so
account   required    pam_time.so

password  required    pam_unix.so     try_first_pass nullok sha512 shadow
password  sufficient                                    pam_sss.so
use_authok
password  optional    pam_permit.so

session   required                                      pam_mkhomedir.so
skel=/etc/skel/ umask=0022
session   required    pam_limits.so
session   required    pam_unix.so
session   optional    pam_sss.so
session   optional    pam_permit.so


User has password valid till 20.02.2020 and yet I don't have any warning.
I had to add ad_gpo_ignore_unreadable = True and ad_gpo_access_control =
permissive to my config because without it I end up with "System error"
during login and unsuccessful login.

In gpo_cache I see Machine gpo with lines:

[Registry Values]
MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,14

Any idea how to turn on this warning?

Thanks for your help!
-----
Best regards,
Pawel

[Sumit Bose]

On Thu, Feb 11, 2021 at 06:47:46PM +0100, Paweł Szafer wrote:
>  Hi,
>  I want to warn users when password expiration days are less than 14 days.
>  
>  I have GPO Default domain policy with this number of days.
>  I have sssd.conf as: 
Hi,

although you define the password policy in AD with GPOs SSSD is using
the information received during Kerberos authentication but by default
it is not displayed.

Please try to set

    pam_pwd_expiration_warning = 14

in the [pam] section of sssd.conf and restart SSSD, see man sssd.conf
for details.

HTH

bye,
Sumit

>  
>  [sssd]
>  domains = internal.domain.tld
>  config_file_version = 2
>  services = nss, pam
>  
>  [domain/internal.domain.tld]
>  cache_credentials = True
>  debug_level = 6
>  id_provider = ad
>  auth_provider = ad
>  access_provider = ad
>  
>  default_shell = /bin/bash
>  fallback_homedir = /home/%d/%u
>  ldap_id_mapping = True
>  ldap_schema = ad
>  enumerate = True
>  ad_site=internal1
>  
>  ad_gpo_access_control = permissive
>  
>  ad_gpo_ignore_unreadable = True
>  
>  And pam.d as follow:
>  
>  #%PAM-1.0
>  
>  auth      sufficient pam_sss.so forward_pass
>  auth      required   pam_unix.so     try_first_pass nullok
>  auth      optional    pam_permit.so
>  auth      required    pam_env.so
>  #auth      requisite    pam_deny.so
>  
>  account   required    pam_unix.so
>  account   [default=bad success=ok user_unknown=ignore]  pam_sss.so
>  account   optional    pam_permit.so
>  account   required    pam_time.so
>  
>  password  required    pam_unix.so     try_first_pass nullok sha512 shadow
>  password  sufficient                                    pam_sss.so
>  use_authok
>  password  optional    pam_permit.so
>  
>  session   required                                      pam_mkhomedir.so
>  skel=/etc/skel/ umask=0022
>  session   required    pam_limits.so
>  session   required    pam_unix.so
>  session   optional    pam_sss.so
>  session   optional    pam_permit.so
>  
>  
>  User has password valid till 20.02.2020 and yet I don't have any warning.
>  I had to add ad_gpo_ignore_unreadable = True and ad_gpo_access_control =
>  permissive to my config because without it I end up with "System error"
>  during login and unsuccessful login.
>  
>  In gpo_cache I see Machine gpo with lines:
>  
>  [Registry Values]
>  MACHINE\Software\Microsoft\Windows
>  NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,14
>  
>  Any idea how to turn on this warning?
>  
>  Thanks for your help!
>  -----
>  Best regards,
>  Pawel 
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Paweł Szafer]

Hi,

I added:

pwd_expiration_warning=14 to domain section

and to pam section:

pam_pwd_expiration_warning=14

but still no warning at all.

-----
Best regards,
Pawel



pt., 12 lut 2021 o 09:39 Sumit Bose <sbose(a)redhat.com&gt; napisał(a):

>  On Thu, Feb 11, 2021 at 06:47:46PM +0100, Paweł Szafer wrote:
>  > Hi,
>  > I want to warn users when password expiration days are less than 14 days.
>  >
>  > I have GPO Default domain policy with this number of days.
>  > I have sssd.conf as:
>
>  Hi,
>
>  although you define the password policy in AD with GPOs SSSD is using
>  the information received during Kerberos authentication but by default
>  it is not displayed.
>
>  Please try to set
>
>      pam_pwd_expiration_warning = 14
>
>  in the [pam] section of sssd.conf and restart SSSD, see man sssd.conf
>  for details.
>
>  HTH
>
>  bye,
>  Sumit
>
>  >
>  > [sssd]
>  > domains = internal.domain.tld
>  > config_file_version = 2
>  > services = nss, pam
>  >
>  > [domain/internal.domain.tld]
>  > cache_credentials = True
>  > debug_level = 6
>  > id_provider = ad
>  > auth_provider = ad
>  > access_provider = ad
>  >
>  > default_shell = /bin/bash
>  > fallback_homedir = /home/%d/%u
>  > ldap_id_mapping = True
>  > ldap_schema = ad
>  > enumerate = True
>  > ad_site=internal1
>  >
>  > ad_gpo_access_control = permissive
>  >
>  > ad_gpo_ignore_unreadable = True
>  >
>  > And pam.d as follow:
>  >
>  > #%PAM-1.0
>  >
>  > auth      sufficient pam_sss.so forward_pass
>  > auth      required   pam_unix.so     try_first_pass nullok
>  > auth      optional    pam_permit.so
>  > auth      required    pam_env.so
>  > #auth      requisite    pam_deny.so
>  >
>  > account   required    pam_unix.so
>  > account   [default=bad success=ok user_unknown=ignore]  pam_sss.so
>  > account   optional    pam_permit.so
>  > account   required    pam_time.so
>  >
>  > password  required    pam_unix.so     try_first_pass nullok sha512 shadow
>  > password  sufficient                                    pam_sss.so
>  > use_authok
>  > password  optional    pam_permit.so
>  >
>  > session   required                                      pam_mkhomedir.so
>  > skel=/etc/skel/ umask=0022
>  > session   required    pam_limits.so
>  > session   required    pam_unix.so
>  > session   optional    pam_sss.so
>  > session   optional    pam_permit.so
>  >
>  >
>  > User has password valid till 20.02.2020 and yet I don't have any warning.
>  > I had to add ad_gpo_ignore_unreadable = True and ad_gpo_access_control =
>  > permissive to my config because without it I end up with "System error"
>  > during login and unsuccessful login.
>  >
>  > In gpo_cache I see Machine gpo with lines:
>  >
>  > [Registry Values]
>  > MACHINE\Software\Microsoft\Windows
>  > NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,14
>  >
>  > Any idea how to turn on this warning?
>  >
>  > Thanks for your help!
>  > -----
>  > Best regards,
>  > Pawel
>
>  > _______________________________________________
>  > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  > Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  > Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>

[Tomas Halman]

On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer <pszafer(a)gmail.com&gt; wrote:

>  > User has password valid till 20.02.2020 and yet I don't have any warning.
> >
>  
Is that just a typo?  20.02.2020 is a year ago...

Tomas

[Paweł Szafer]

yes, typo, sorry. It's valid till 20.02.2021.
Unfortunately I cannot find anything about password expiration in the sssd
logs.

Pawel

pon., 15 lut 2021, 11:08 użytkownik Tomas Halman <thalman(a)redhat.com&gt;
napisał:

>  On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer <pszafer(a)gmail.com&gt; wrote:
>
> >
> > > User has password valid till 20.02.2020 and yet I don't have any
> >> warning.
> >>
> >
>  Is that just a typo?  20.02.2020 is a year ago...
>
>  Tomas
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>

[Paweł Szafer]

only thing I see about password expiration in logs are

confdb_get_domain_internal] (0x0100): Setting domain password expiration
warning to 14 days
./sssd_internal.domain.tld.log:(2021-02-11 18:43:58):
[be[internal.domain.tld]] [dp_get_options] (0x0400): Option
account_cache_expiration has value 0
./sssd_internal.domain.tld.log:(2021-02-11 18:43:58):
[be[internal.domain.tld]] [dp_get_options] (0x0400): Option
ldap_account_expire_policy has value ad
./sssd_internal.domain.tld.log:(2021-02-11 18:43:58):
[be[internal.domain.tld]] [dp_get_options] (0x0400): Option
ldap_connection_expire_timeout has value 900
./sssd_internal.domain.tld.log:(2021-02-11 18:43:58):
[be[internal.domain.tld]] [dp_get_options] (0x0400): Option
ldap_connection_expire_offset has value 0
./sssd_internal.domain.tld.log:(2021-02-11 18:43:58):
[be[internal.domain.tld]] [sdap_get_map] (0x0400): Option
ldap_user_shadow_expire has no value
./sssd_internal.domain.tld.log:(2021-02-11 18:43:58):
[be[internal.domain.tld]] [sdap_get_map] (0x0400): Option
ldap_user_krb_password_expiration has no value

./sssd_internal.domain.tld.log:(2021-02-11 18:43:58):
[be[internal.domain.tld]] [sdap_get_map] (0x0400): Option
ldap_user_ad_account_expires has value accountExpires
./sssd_internal.domain.tld.log:(2021-02-11 18:43:58):
[be[internal.domain.tld]] [sdap_get_map] (0x0400): Option
ldap_user_nds_login_expiration_time has no value
./sssd_internal.domain.tld.log:(2021-02-11 18:43:58):
[be[internal.domain.tld]] [sdap_get_tgt_recv] (0x0400): Child responded: 0
[FILE:/var/lib/sss/db/ccache_internal.domain.tld], expired on [16
13101438]



This is what I see in domain controller
[image: image.png]
----
Pawel


pon., 15 lut 2021 o 11:13 Paweł Szafer <pszafer(a)gmail.com&gt; napisał(a):

>  yes, typo, sorry. It's valid till 20.02.2021.
>  Unfortunately I cannot find anything about password expiration in the sssd
>  logs.
>
>  Pawel
>
>  pon., 15 lut 2021, 11:08 użytkownik Tomas Halman <thalman(a)redhat.com&gt;
>  napisał:
>
> >
> >
> > On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer <pszafer(a)gmail.com&gt; wrote:
> >
> >>
> >> > User has password valid till 20.02.2020 and yet I don't have any
> >>> warning.
> >>>
> >>
> > Is that just a typo?  20.02.2020 is a year ago...
> >
> > Tomas
> > _______________________________________________
> > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam on the list, report it:
> > https://pagure.io/fedora-infrastructure
> >
>

[Paweł Szafer]

Hi again,
I installed Centos 8 to test if warning is working and on Centos it is
working properly.

In Arch I never get line with check "sss_krb5_expire_callback_func"

Here are logs and config compared:
https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa (can't
attach it to email, too big).
Maybe you can find out if it's something with config or maybe Arch
compilation of krb5 or sssd.

-----
Pawel



pon., 15 lut 2021 o 11:13 Paweł Szafer <pszafer(a)gmail.com&gt; napisał(a):

>  yes, typo, sorry. It's valid till 20.02.2021.
>  Unfortunately I cannot find anything about password expiration in the sssd
>  logs.
>
>  Pawel
>
>  pon., 15 lut 2021, 11:08 użytkownik Tomas Halman <thalman(a)redhat.com&gt;
>  napisał:
>
> >
> >
> > On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer <pszafer(a)gmail.com&gt; wrote:
> >
> >>
> >> > User has password valid till 20.02.2020 and yet I don't have any
> >>> warning.
> >>>
> >>
> > Is that just a typo?  20.02.2020 is a year ago...
> >
> > Tomas
> > _______________________________________________
> > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam on the list, report it:
> > https://pagure.io/fedora-infrastructure
> >
>

[Sumit Bose]

On Tue, Feb 16, 2021 at 03:46:38PM +0100, Paweł Szafer wrote:
>  Hi again,
>  I installed Centos 8 to test if warning is working and on Centos it is
>  working properly.
>  
>  In Arch I never get line with check "sss_krb5_expire_callback_func"
>  
>  Here are logs and config compared:
>  https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa (can't
>  attach it to email, too big).
>  Maybe you can find out if it's something with config or maybe Arch
>  compilation of krb5 or sssd. 
Hi,

this might be possible. If seen in
https://github.com/archlinux/svntogit-community/blob/packages/sssd/trunk/...
the HAVE_KRB5_SET_TRACE_CALLBACK is removed from config.h which would
explain the missing krb5 trace messages in the logs.

The expiration callback is used conditionally, but the related call is
available since MIT Kerberos version 1.9. Can you check the configure
output

......
checking for krb5_get_error_message... yes
checking for krb5_free_unparsed_name... yes
checking for krb5_get_init_creds_opt_set_expire_callback... yes      <<<----
checking for krb5_get_init_creds_opt_set_fast_ccache_name... yes
checking for krb5_get_init_creds_opt_set_fast_flags... yes
checking for krb5_get_init_creds_opt_set_canonicalize... yes
......

But even if krb5_get_init_creds_opt_set_expire_callback is not available
I would expect a message in the debug logs.


In krb5.conf on Arch there is

[libdefaults]
 udp_preference_limit = 0

which is not present on Centos. I wonder if you can comment out those
two lines for testing. I would be surprised if this would change
anything but it is the only difference which might be related.

bye,
Sumit

>  
>  -----
>  Pawel
>  
>  
>  
>  pon., 15 lut 2021 o 11:13 Paweł Szafer <pszafer(a)gmail.com&gt; napisał(a):
>  
>  > yes, typo, sorry. It's valid till 20.02.2021.
>  > Unfortunately I cannot find anything about password expiration in the sssd
>  > logs.
>  >
>  > Pawel
>  >
>  > pon., 15 lut 2021, 11:08 użytkownik Tomas Halman <thalman(a)redhat.com&gt;
>  > napisał:
>  >
>  >>
>  >>
>  >> On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer <pszafer(a)gmail.com&gt; wrote:
>  >>
>  >>>
>  >>> > User has password valid till 20.02.2020 and yet I don't have any
>  >>>> warning.
>  >>>>
>  >>>
>  >> Is that just a typo?  20.02.2020 is a year ago...
>  >>
>  >> Tomas
>  >> _______________________________________________
>  >> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  >> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  >> Fedora Code of Conduct:
>  >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  >> List Archives:
>  >> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  >> Do not reply to spam on the list, report it:
>  >> https://pagure.io/fedora-infrastructure
>  >>
>  > 
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Paweł Szafer]

Thanks for the response!

Commenting out "udp_preference_limit" doesn't change anything
unfortunately...
I will rebuild sssd from source, so I can get more meaningful logs.

-----
Pawel



wt., 16 lut 2021 o 17:20 Sumit Bose <sbose(a)redhat.com&gt; napisał(a):

>  On Tue, Feb 16, 2021 at 03:46:38PM +0100, Paweł Szafer wrote:
>  > Hi again,
>  > I installed Centos 8 to test if warning is working and on Centos it is
>  > working properly.
>  >
>  > In Arch I never get line with check "sss_krb5_expire_callback_func"
>  >
>  > Here are logs and config compared:
>  > https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa (can't
>  > attach it to email, too big).
>  > Maybe you can find out if it's something with config or maybe Arch
>  > compilation of krb5 or sssd.
>
>  Hi,
>
>  this might be possible. If seen in
>
>  https://github.com/archlinux/svntogit-community/blob/packages/sssd/trunk/...
>  the HAVE_KRB5_SET_TRACE_CALLBACK is removed from config.h which would
>  explain the missing krb5 trace messages in the logs.
>
>  The expiration callback is used conditionally, but the related call is
>  available since MIT Kerberos version 1.9. Can you check the configure
>  output
>
>  ......
>  checking for krb5_get_error_message... yes
>  checking for krb5_free_unparsed_name... yes
>  checking for krb5_get_init_creds_opt_set_expire_callback... yes
>  <<<----
>  checking for krb5_get_init_creds_opt_set_fast_ccache_name... yes
>  checking for krb5_get_init_creds_opt_set_fast_flags... yes
>  checking for krb5_get_init_creds_opt_set_canonicalize... yes
>  ......
>
>  But even if krb5_get_init_creds_opt_set_expire_callback is not available
>  I would expect a message in the debug logs.
>
>
>  In krb5.conf on Arch there is
>
>  [libdefaults]
>   udp_preference_limit = 0
>
>  which is not present on Centos. I wonder if you can comment out those
>  two lines for testing. I would be surprised if this would change
>  anything but it is the only difference which might be related.
>
>  bye,
>  Sumit
>
>  >
>  > -----
>  > Pawel
>  >
>  >
>  >
>  > pon., 15 lut 2021 o 11:13 Paweł Szafer <pszafer(a)gmail.com&gt; napisał(a):
>  >
>  > > yes, typo, sorry. It's valid till 20.02.2021.
>  > > Unfortunately I cannot find anything about password expiration in the
>  sssd
>  > > logs.
>  > >
>  > > Pawel
>  > >
>  > > pon., 15 lut 2021, 11:08 użytkownik Tomas Halman <thalman(a)redhat.com&gt;
>  > > napisał:
>  > >
>  > >>
>  > >>
>  > >> On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer <pszafer(a)gmail.com&gt;
>  wrote:
>  > >>
>  > >>>
>  > >>> > User has password valid till 20.02.2020 and yet I don't have
> any
>  > >>>> warning.
>  > >>>>
>  > >>>
>  > >> Is that just a typo?  20.02.2020 is a year ago...
>  > >>
>  > >> Tomas
>  > >> _______________________________________________
>  > >> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  > >> To unsubscribe send an email to
>  sssd-users-leave(a)lists.fedorahosted.org
>  > >> Fedora Code of Conduct:
>  > >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  > >> List Guidelines:
>  https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > >> List Archives:
>  > >>
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  > >> Do not reply to spam on the list, report it:
>  > >> https://pagure.io/fedora-infrastructure
>  > >>
>  > >
>
>  > _______________________________________________
>  > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  > Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  > Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>

[Paweł Szafer]

Hi,
I built and installed sssd from sources.
I got more logs:
https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa#file-krb...

Is this important? -> "PKINIT client has no configured identity; giving up"
In Centos there are lines in krb5 conf, I think this is the reason above is
giving up.

pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
spake_preauth_groups = edwards25519

Are those important?

This function is never called in Arch (line is from centos):

[krb5_child[50670]] [sss_krb5_expire_callback_func] (0x2000): exp_time:
[375772]

How to find why this function is never called?

-----
Pawel



wt., 16 lut 2021 o 17:38 Paweł Szafer <pszafer(a)gmail.com&gt; napisał(a):

>  Thanks for the response!
>
>  Commenting out "udp_preference_limit" doesn't change anything
>  unfortunately...
>  I will rebuild sssd from source, so I can get more meaningful logs.
>
>  -----
>  Pawel
>
>
>
>  wt., 16 lut 2021 o 17:20 Sumit Bose <sbose(a)redhat.com&gt; napisał(a):
>
> > On Tue, Feb 16, 2021 at 03:46:38PM +0100, Paweł Szafer wrote:
> > > Hi again,
> > > I installed Centos 8 to test if warning is working and on Centos it is
> > > working properly.
> > >
> > > In Arch I never get line with check "sss_krb5_expire_callback_func"
> > >
> > > Here are logs and config compared:
> > > https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa (can't
> > > attach it to email, too big).
> > > Maybe you can find out if it's something with config or maybe Arch
> > > compilation of krb5 or sssd.
> >
> > Hi,
> >
> > this might be possible. If seen in
> >
> > https://github.com/archlinux/svntogit-community/blob/packages/sssd/trunk/...
> > the HAVE_KRB5_SET_TRACE_CALLBACK is removed from config.h which would
> > explain the missing krb5 trace messages in the logs.
> >
> > The expiration callback is used conditionally, but the related call is
> > available since MIT Kerberos version 1.9. Can you check the configure
> > output
> >
> > ......
> > checking for krb5_get_error_message... yes
> > checking for krb5_free_unparsed_name... yes
> > checking for krb5_get_init_creds_opt_set_expire_callback... yes
> > <<<----
> > checking for krb5_get_init_creds_opt_set_fast_ccache_name... yes
> > checking for krb5_get_init_creds_opt_set_fast_flags... yes
> > checking for krb5_get_init_creds_opt_set_canonicalize... yes
> > ......
> >
> > But even if krb5_get_init_creds_opt_set_expire_callback is not available
> > I would expect a message in the debug logs.
> >
> >
> > In krb5.conf on Arch there is
> >
> > [libdefaults]
> >  udp_preference_limit = 0
> >
> > which is not present on Centos. I wonder if you can comment out those
> > two lines for testing. I would be surprised if this would change
> > anything but it is the only difference which might be related.
> >
> > bye,
> > Sumit
> >
> > >
> > > -----
> > > Pawel
> > >
> > >
> > >
> > > pon., 15 lut 2021 o 11:13 Paweł Szafer <pszafer(a)gmail.com&gt; napisał(a):
> > >
> > > > yes, typo, sorry. It's valid till 20.02.2021.
> > > > Unfortunately I cannot find anything about password expiration in the
> > sssd
> > > > logs.
> > > >
> > > > Pawel
> > > >
> > > > pon., 15 lut 2021, 11:08 użytkownik Tomas Halman
> <thalman(a)redhat.com&gt;
> > > > napisał:
> > > >
> > > >>
> > > >>
> > > >> On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer <pszafer(a)gmail.com&gt;
> > wrote:
> > > >>
> > > >>>
> > > >>> > User has password valid till 20.02.2020 and yet I don't
> have any
> > > >>>> warning.
> > > >>>>
> > > >>>
> > > >> Is that just a typo?  20.02.2020 is a year ago...
> > > >>
> > > >> Tomas
> > > >> _______________________________________________
> > > >> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> > > >> To unsubscribe send an email to
> > sssd-users-leave(a)lists.fedorahosted.org
> > > >> Fedora Code of Conduct:
> > > >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > >> List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > >> List Archives:
> > > >>
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > >> Do not reply to spam on the list, report it:
> > > >> https://pagure.io/fedora-infrastructure
> > > >>
> > > >
> >
> > > _______________________________________________
> > > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> > > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > Do not reply to spam on the list, report it:
> > https://pagure.io/fedora-infrastructure
> > _______________________________________________
> > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam on the list, report it:
> > https://pagure.io/fedora-infrastructure
> >
>

[Sumit Bose]

On Wed, Feb 17, 2021 at 12:43:09PM +0100, Paweł Szafer wrote:
>  Hi,
>  I built and installed sssd from sources.
>  I got more logs:
>
> https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa#file-krb...
>  
>  Is this important? -> "PKINIT client has no configured identity; giving up"
>  In Centos there are lines in krb5 conf, I think this is the reason above is
>  giving up.
>  
>  pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
>  spake_preauth_groups = edwards25519
>  
>  Are those important?
>  
>  This function is never called in Arch (line is from centos):
>  
>  [krb5_child[50670]] [sss_krb5_expire_callback_func] (0x2000): exp_time:
>  [375772]
>  
>  How to find why this function is never called? 
Hi,

it looks like I'm getting old, I forgot about
https://krbdev.mit.edu/rt/Ticket/Display.html?id=8893 which is an issue
in MIT Kerberos which should be fixed in 1.19 but might not yet fixed in
Arch Linux.

As a workaround you can try to use 'auth_provider = krb5' but please
note the different defaults for krb5_validate and
krb5_use_enterprise_principal as mentioned in man sssd-ad.

With 'auth_provider = ad' some different MIT Kerberos APIs are used to
get more details from AD, unfortunately due to #8893 the expiration time
is lost in this case.

HTH

bye,
Sumit

>  
>  -----
>  Pawel
>  
>  
>  
>  wt., 16 lut 2021 o 17:38 Paweł Szafer <pszafer(a)gmail.com&gt; napisał(a):
>  
>  > Thanks for the response!
>  >
>  > Commenting out "udp_preference_limit" doesn't change anything
>  > unfortunately...
>  > I will rebuild sssd from source, so I can get more meaningful logs.
>  >
>  > -----
>  > Pawel
>  >
>  >
>  >
>  > wt., 16 lut 2021 o 17:20 Sumit Bose <sbose(a)redhat.com&gt; napisał(a):
>  >
>  >> On Tue, Feb 16, 2021 at 03:46:38PM +0100, Paweł Szafer wrote:
>  >> > Hi again,
>  >> > I installed Centos 8 to test if warning is working and on Centos it is
>  >> > working properly.
>  >> >
>  >> > In Arch I never get line with check
> "sss_krb5_expire_callback_func"
>  >> >
>  >> > Here are logs and config compared:
>  >> > https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa
> (can't
>  >> > attach it to email, too big).
>  >> > Maybe you can find out if it's something with config or maybe Arch
>  >> > compilation of krb5 or sssd.
>  >>
>  >> Hi,
>  >>
>  >> this might be possible. If seen in
>  >>
>  >>
> https://github.com/archlinux/svntogit-community/blob/packages/sssd/trunk/...
>  >> the HAVE_KRB5_SET_TRACE_CALLBACK is removed from config.h which would
>  >> explain the missing krb5 trace messages in the logs.
>  >>
>  >> The expiration callback is used conditionally, but the related call is
>  >> available since MIT Kerberos version 1.9. Can you check the configure
>  >> output
>  >>
>  >> ......
>  >> checking for krb5_get_error_message... yes
>  >> checking for krb5_free_unparsed_name... yes
>  >> checking for krb5_get_init_creds_opt_set_expire_callback... yes
>  >> <<<----
>  >> checking for krb5_get_init_creds_opt_set_fast_ccache_name... yes
>  >> checking for krb5_get_init_creds_opt_set_fast_flags... yes
>  >> checking for krb5_get_init_creds_opt_set_canonicalize... yes
>  >> ......
>  >>
>  >> But even if krb5_get_init_creds_opt_set_expire_callback is not available
>  >> I would expect a message in the debug logs.
>  >>
>  >>
>  >> In krb5.conf on Arch there is
>  >>
>  >> [libdefaults]
>  >>  udp_preference_limit = 0
>  >>
>  >> which is not present on Centos. I wonder if you can comment out those
>  >> two lines for testing. I would be surprised if this would change
>  >> anything but it is the only difference which might be related.
>  >>
>  >> bye,
>  >> Sumit
>  >>
>  >> >
>  >> > -----
>  >> > Pawel
>  >> >
>  >> >
>  >> >
>  >> > pon., 15 lut 2021 o 11:13 Paweł Szafer <pszafer(a)gmail.com&gt;
> napisał(a):
>  >> >
>  >> > > yes, typo, sorry. It's valid till 20.02.2021.
>  >> > > Unfortunately I cannot find anything about password expiration in the
>  >> sssd
>  >> > > logs.
>  >> > >
>  >> > > Pawel
>  >> > >
>  >> > > pon., 15 lut 2021, 11:08 użytkownik Tomas Halman
> <thalman(a)redhat.com&gt;
>  >> > > napisał:
>  >> > >
>  >> > >>
>  >> > >>
>  >> > >> On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer
> <pszafer(a)gmail.com&gt;
>  >> wrote:
>  >> > >>
>  >> > >>>
>  >> > >>> > User has password valid till 20.02.2020 and yet I
> don't have any
>  >> > >>>> warning.
>  >> > >>>>
>  >> > >>>
>  >> > >> Is that just a typo?  20.02.2020 is a year ago...
>  >> > >>
>  >> > >> Tomas
>  >> > >> _______________________________________________
>  >> > >> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  >> > >> To unsubscribe send an email to
>  >> sssd-users-leave(a)lists.fedorahosted.org
>  >> > >> Fedora Code of Conduct:
>  >> > >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  >> > >> List Guidelines:
>  >> https://fedoraproject.org/wiki/Mailing_list_guidelines
>  >> > >> List Archives:
>  >> > >>
>  >> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  >> > >> Do not reply to spam on the list, report it:
>  >> > >> https://pagure.io/fedora-infrastructure
>  >> > >>
>  >> > >
>  >>
>  >> > _______________________________________________
>  >> > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  >> > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  >> > Fedora Code of Conduct:
>  >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  >> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  >> > List Archives:
>  >> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  >> > Do not reply to spam on the list, report it:
>  >> https://pagure.io/fedora-infrastructure
>  >> _______________________________________________
>  >> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  >> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  >> Fedora Code of Conduct:
>  >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  >> List Archives:
>  >> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  >> Do not reply to spam on the list, report it:
>  >> https://pagure.io/fedora-infrastructure
>  >>
>  > 
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Paweł Szafer]

Hi,

Thanks for the response! I thought that there was no hope...
Arch krb5 is outdated https://archlinux.org/packages/core/x86_64/krb5/.
I'll wait for 1.19 and post back with the result.

-----
Pawel



wt., 2 mar 2021 o 18:27 Sumit Bose <sbose(a)redhat.com&gt; napisał(a):

>  On Wed, Feb 17, 2021 at 12:43:09PM +0100, Paweł Szafer wrote:
>  > Hi,
>  > I built and installed sssd from sources.
>  > I got more logs:
>  >
>
> https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa#file-krb...
>  >
>  > Is this important? -> "PKINIT client has no configured identity; giving
>  up"
>  > In Centos there are lines in krb5 conf, I think this is the reason above
>  is
>  > giving up.
>  >
>  > pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
>  > spake_preauth_groups = edwards25519
>  >
>  > Are those important?
>  >
>  > This function is never called in Arch (line is from centos):
>  >
>  > [krb5_child[50670]] [sss_krb5_expire_callback_func] (0x2000): exp_time:
>  > [375772]
>  >
>  > How to find why this function is never called?
>
>  Hi,
>
>  it looks like I'm getting old, I forgot about
>  https://krbdev.mit.edu/rt/Ticket/Display.html?id=8893 which is an issue
>  in MIT Kerberos which should be fixed in 1.19 but might not yet fixed in
>  Arch Linux.
>
>  As a workaround you can try to use 'auth_provider = krb5' but please
>  note the different defaults for krb5_validate and
>  krb5_use_enterprise_principal as mentioned in man sssd-ad.
>
>  With 'auth_provider = ad' some different MIT Kerberos APIs are used to
>  get more details from AD, unfortunately due to #8893 the expiration time
>  is lost in this case.
>
>  HTH
>
>  bye,
>  Sumit
>
>  >
>  > -----
>  > Pawel
>  >
>  >
>  >
>  > wt., 16 lut 2021 o 17:38 Paweł Szafer <pszafer(a)gmail.com&gt; napisał(a):
>  >
>  > > Thanks for the response!
>  > >
>  > > Commenting out "udp_preference_limit" doesn't change anything
>  > > unfortunately...
>  > > I will rebuild sssd from source, so I can get more meaningful logs.
>  > >
>  > > -----
>  > > Pawel
>  > >
>  > >
>  > >
>  > > wt., 16 lut 2021 o 17:20 Sumit Bose <sbose(a)redhat.com&gt; napisał(a):
>  > >
>  > >> On Tue, Feb 16, 2021 at 03:46:38PM +0100, Paweł Szafer wrote:
>  > >> > Hi again,
>  > >> > I installed Centos 8 to test if warning is working and on Centos it
>  is
>  > >> > working properly.
>  > >> >
>  > >> > In Arch I never get line with check
> "sss_krb5_expire_callback_func"
>  > >> >
>  > >> > Here are logs and config compared:
>  > >> > https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa
>  (can't
>  > >> > attach it to email, too big).
>  > >> > Maybe you can find out if it's something with config or maybe
> Arch
>  > >> > compilation of krb5 or sssd.
>  > >>
>  > >> Hi,
>  > >>
>  > >> this might be possible. If seen in
>  > >>
>  > >>
>  https://github.com/archlinux/svntogit-community/blob/packages/sssd/trunk/...
>  > >> the HAVE_KRB5_SET_TRACE_CALLBACK is removed from config.h which would
>  > >> explain the missing krb5 trace messages in the logs.
>  > >>
>  > >> The expiration callback is used conditionally, but the related call is
>  > >> available since MIT Kerberos version 1.9. Can you check the configure
>  > >> output
>  > >>
>  > >> ......
>  > >> checking for krb5_get_error_message... yes
>  > >> checking for krb5_free_unparsed_name... yes
>  > >> checking for krb5_get_init_creds_opt_set_expire_callback... yes
>  > >> <<<----
>  > >> checking for krb5_get_init_creds_opt_set_fast_ccache_name... yes
>  > >> checking for krb5_get_init_creds_opt_set_fast_flags... yes
>  > >> checking for krb5_get_init_creds_opt_set_canonicalize... yes
>  > >> ......
>  > >>
>  > >> But even if krb5_get_init_creds_opt_set_expire_callback is not
>  available
>  > >> I would expect a message in the debug logs.
>  > >>
>  > >>
>  > >> In krb5.conf on Arch there is
>  > >>
>  > >> [libdefaults]
>  > >>  udp_preference_limit = 0
>  > >>
>  > >> which is not present on Centos. I wonder if you can comment out those
>  > >> two lines for testing. I would be surprised if this would change
>  > >> anything but it is the only difference which might be related.
>  > >>
>  > >> bye,
>  > >> Sumit
>  > >>
>  > >> >
>  > >> > -----
>  > >> > Pawel
>  > >> >
>  > >> >
>  > >> >
>  > >> > pon., 15 lut 2021 o 11:13 Paweł Szafer <pszafer(a)gmail.com&gt;
>  napisał(a):
>  > >> >
>  > >> > > yes, typo, sorry. It's valid till 20.02.2021.
>  > >> > > Unfortunately I cannot find anything about password expiration
> in
>  the
>  > >> sssd
>  > >> > > logs.
>  > >> > >
>  > >> > > Pawel
>  > >> > >
>  > >> > > pon., 15 lut 2021, 11:08 użytkownik Tomas Halman <
>  thalman(a)redhat.com&gt;
>  > >> > > napisał:
>  > >> > >
>  > >> > >>
>  > >> > >>
>  > >> > >> On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer
> <pszafer(a)gmail.com&gt;
>  > >> wrote:
>  > >> > >>
>  > >> > >>>
>  > >> > >>> > User has password valid till 20.02.2020 and yet I
> don't have
>  any
>  > >> > >>>> warning.
>  > >> > >>>>
>  > >> > >>>
>  > >> > >> Is that just a typo?  20.02.2020 is a year ago...
>  > >> > >>
>  > >> > >> Tomas
>  > >> > >> _______________________________________________
>  > >> > >> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  > >> > >> To unsubscribe send an email to
>  > >> sssd-users-leave(a)lists.fedorahosted.org
>  > >> > >> Fedora Code of Conduct:
>  > >> > >>
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  > >> > >> List Guidelines:
>  > >> https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > >> > >> List Archives:
>  > >> > >>
>  > >>
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  > >> > >> Do not reply to spam on the list, report it:
>  > >> > >> https://pagure.io/fedora-infrastructure
>  > >> > >>
>  > >> > >
>  > >>
>  > >> > _______________________________________________
>  > >> > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  > >> > To unsubscribe send an email to
>  sssd-users-leave(a)lists.fedorahosted.org
>  > >> > Fedora Code of Conduct:
>  > >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  > >> > List Guidelines:
>  https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > >> > List Archives:
>  > >>
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  > >> > Do not reply to spam on the list, report it:
>  > >> https://pagure.io/fedora-infrastructure
>  > >> _______________________________________________
>  > >> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  > >> To unsubscribe send an email to
>  sssd-users-leave(a)lists.fedorahosted.org
>  > >> Fedora Code of Conduct:
>  > >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  > >> List Guidelines:
>  https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > >> List Archives:
>  > >>
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  > >> Do not reply to spam on the list, report it:
>  > >> https://pagure.io/fedora-infrastructure
>  > >>
>  > >
>
>  > _______________________________________________
>  > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  > Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  > Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>