Running 'sudo su' creates kerberos ticket for user on old IPA (4.6) not on new 4.10

[Finn Fysj]

I'm trying to setup new IPA server and when I run 'sudo su' I get prompted
with password, which is fine.
However, when I successfully type my password on a RHEL7 instance running FreeIPA version
4.6 I get a kerberos ticket as the logged-in user in "root-mode", but when I do
the same in the newer IPA instance I do not get any kerberos ticket when in root. 

How do I get kerberos ticket when I run 'sudo su'?

[Sumit Bose]

Am Wed, May 03, 2023 at 12:00:16PM -0000 schrieb Finn Fysj via FreeIPA-users:
>  I'm trying to setup new IPA server and when I run 'sudo
> su' I get
>  prompted with password, which is fine.
>  However, when I successfully type my password on a RHEL7 instance
>  running FreeIPA version 4.6 I get a kerberos ticket as the logged-in
>  user in "root-mode", but when I do the same in the newer IPA instance
>  I do not get any kerberos ticket when in root. 
>  
>  How do I get kerberos ticket when I run 'sudo su'? 
Hi,

the behavior was changed due to
https://bugzilla.redhat.com/show_bug.cgi?id=1879869
https://github.com/SSSD/sssd/issues/5660

To switch back to the old behavior you can add

    pam_response_filter=-ENV:KRB5CCNAME:sudo-i, -ENV:KRB5CCNAME:sudo

to the [pam] section in sssd.conf or as snippet in /etc/sssd.d/conf.d.

HTH

bye,
Sumit

>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Finn Fysj]

>  Am Wed, May 03, 2023 at 12:00:16PM -0000 schrieb Finn Fysj via
> FreeIPA-users:
>  
>  Hi,
>  
>  the behavior was changed due to
>  https://bugzilla.redhat.com/show_bug.cgi?id=1879869
>  https://github.com/SSSD/sssd/issues/5660
>  
>  To switch back to the old behavior you can add
>  
>      pam_response_filter=-ENV:KRB5CCNAME:sudo-i, -ENV:KRB5CCNAME:sudo
>  
>  to the [pam] section in sssd.conf or as snippet in /etc/sssd.d/conf.d.
>  
>  HTH
>  
>  bye,
>  Sumit 
Not able to view this Sumit, but thanks.

You are not authorized to access bug #1879869.

Most likely the bug has been restricted for internal development processes and we cannot
grant access.

If your role requires it then you may be able to use the self service Request Group
Membership workflow to gain the permissions required to access this bug.

If you are a Red Hat customer with an active subscription, please visit the Red Hat
Customer Portal for assistance with your issue

If you are a Fedora Project user and require assistance, please consider using one of the
mailing lists we host for the Fedora Project.

[Sumit Bose]

Am Wed, May 03, 2023 at 02:40:30PM -0000 schrieb Finn Fysj via FreeIPA-users:
>  > Am Wed, May 03, 2023 at 12:00:16PM -0000 schrieb Finn Fysj via
> FreeIPA-users:
>  > 
>  > Hi,
>  > 
>  > the behavior was changed due to
>  > https://bugzilla.redhat.com/show_bug.cgi?id=1879869
>  > https://github.com/SSSD/sssd/issues/5660
>  > 
>  > To switch back to the old behavior you can add
>  > 
>  >     pam_response_filter=-ENV:KRB5CCNAME:sudo-i, -ENV:KRB5CCNAME:sudo
>  > 
>  > to the [pam] section in sssd.conf or as snippet in /etc/sssd.d/conf.d.
>  > 
>  > HTH
>  > 
>  > bye,
>  > Sumit
>  Not able to view this Sumit, but thanks.
>  
>  You are not authorized to access bug #1879869. 
Hi,

the github ticket has at least a copy of the description of the bugzilla
ticket.

bye,
Sumit

>  
>  Most likely the bug has been restricted for internal development processes and we cannot
> grant access.
>  
>  If your role requires it then you may be able to use the self service Request Group
> Membership workflow to gain the permissions required to access this bug.
>  
>  If you are a Red Hat customer with an active subscription, please visit the Red Hat
> Customer Portal for assistance with your issue
>  
>  If you are a Fedora Project user and require assistance, please consider using one of the
> mailing lists we host for the Fedora Project.
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue