Could not login with AD user

[Ronald Wimmer]

Today I was not able to log in with an AD user to an IPA client within a 
test setup. IPA users worked fine.

DNS is managed externally. I figured out that the DNS-Record of that 
particular IPA client has not been created correctly. After having 
corrected the DNS entry and having dropped the SSSD cache on that client 
I could login with my AD user.

Do you have an explanation for that or was it just a coincidence?

Cheers,
Ronald

[Sumit Bose]

On Wed, Nov 06, 2019 at 12:20:21AM +0100, Ronald Wimmer via FreeIPA-users wrote:
>  Today I was not able to log in with an AD user to an IPA client
> within a
>  test setup. IPA users worked fine.
>  
>  DNS is managed externally. I figured out that the DNS-Record of that
>  particular IPA client has not been created correctly. After having corrected
>  the DNS entry and having dropped the SSSD cache on that client I could login
>  with my AD user.
>  
>  Do you have an explanation for that or was it just a coincidence? 
Hi,

it depends on what 'not able to log in' means. If it e.g. means that you
tried to log in from a Windows clients with putty or similar then with a
broken DNS record putty will not be able to find or connect to the
expected IPA client.

bye,
Sumit

>  
>  Cheers,
>  Ronald
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[Ronald Wimmer]

On 06.11.19 08:08, Sumit Bose via FreeIPA-users wrote:
>  On Wed, Nov 06, 2019 at 12:20:21AM +0100, Ronald Wimmer via
> FreeIPA-users wrote:
> > Today I was not able to log in with an AD user to an IPA client within a
> > test setup. IPA users worked fine.
> >
> > DNS is managed externally. I figured out that the DNS-Record of that
> > particular IPA client has not been created correctly. After having corrected
> > the DNS entry and having dropped the SSSD cache on that client I could login
> > with my AD user.
> >
> > Do you have an explanation for that or was it just a coincidence?
>  Hi,
>
>  it depends on what 'not able to log in' means. If it e.g. means that you
>  tried to log in from a Windows clients with putty or similar then with a
>  broken DNS record putty will not be able to find or connect to the
>  expected IPA client. 
I entered the credentials of my AD user and was prompted for the 
password several times.

Cheers,
Ronald

[Ronald Wimmer]

The only log entries that appear when a different user tries it do 
appear in /var/log/secure:

Nov  6 10:33:19 ws102317180 sshd[24003]: Invalid user 
an_ad_user(a)bau.mydomain.at from 10.16.11.218 port 60646
Nov  6 10:33:19 ws102317180 sshd[24003]: input_userauth_request: invalid 
user an_ad_user(a)bau.mydomain.at [preauth]
Nov  6 10:33:19 ws102317180 sshd[24003]: Postponed keyboard-interactive 
for invalid user an_ad_user(a)bau.mydomain.at from 10.16.11.218 port 60646 
ssh2 [preauth]
Nov  6 10:33:26 ws102317180 sshd[24005]: pam_unix(sshd:auth): check 
pass; user unknown
Nov  6 10:33:26 ws102317180 sshd[24005]: pam_unix(sshd:auth): 
authentication failure; logname= uid=0 euid=0 tty=ssh ruser= 
rhost=somehost.bau.mydomain.at
Nov  6 10:33:28 ws102317180 sshd[24003]: error: PAM: User not known to 
the underlying authentication module for illegal user 
an_ad_user(a)bau.mydomain.at from somehost.bau.mydomain.at
Nov  6 10:33:28 ws102317180 sshd[24003]: Failed keyboard-interactive/pam 
for invalid user an_ad_user(a)bau.mydomain.at from 10.16.11.218 port 60646 
ssh2
Nov  6 10:33:28 ws102317180 sshd[24003]: Postponed keyboard-interactive 
for invalid user an_ad_user(a)bau.mydomain.at from 10.16.11.218 port 60646 
ssh2 [preauth]
Nov  6 10:33:38 ws102317180 sshd[24006]: pam_unix(sshd:auth): check 
pass; user unknown
Nov  6 10:33:38 ws102317180 sshd[24006]: pam_unix(sshd:auth): 
authentication failure; logname= uid=0 euid=0 tty=ssh ruser= 
rhost=somehost.bau.mydomain.at
Nov  6 10:33:39 ws102317180 sshd[24003]: error: PAM: User not known to 
the underlying authentication module for illegal user 
an_ad_user(a)bau.mydomain.at from as03184.bau.mydomain.at
Nov  6 10:33:39 ws102317180 sshd[24003]: Failed keyboard-interactive/pam 
for invalid user an_ad_user(a)bau.mydomain.at from 10.16.11.218 port 60646 
ssh2
Nov  6 10:33:39 ws102317180 sshd[24003]: Postponed keyboard-interactive 
for invalid user an_ad_user(a)bau.mydomain.at from 10.16.11.218 port 60646 
ssh2 [preauth]

[Ronald Wimmer]

On one of the IPA servers themselves a

getent passwd myaduser(a)bau.mydomain.at

is working. On the system where I cannot login with this user I do not 
get a result.

What do I have to look for in which sssd log file in order to find out 
what the problem is?

Cheers,
Ronald

[Ronald Wimmer]

Simply increasing the krb5_auth_timeout in the client's sssd.conf did 
the trick. Thanks for the good troubleshooting guide at 
https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html

Cheers,
Ronald

[Ronald Wimmer]

It seems that this was a coincidence... sometimes AD users are found but 
most of the time they are not:

[root@ipaclient sssd]# id usera(a)bau.mydomain.at
id: usera(a)bau.mydomain.at: No such user
[root@ipaclient sssd]# id userb(a)bau.mydomain.at
id: userb(a)bau.mydomain.at: No such user

Where do I have to take a closer look?

Cheers,
Ronald

[Sumit Bose]

On Fri, Nov 08, 2019 at 10:04:41AM +0100, Ronald Wimmer via FreeIPA-users wrote:
>  It seems that this was a coincidence... sometimes AD users are found
> but
>  most of the time they are not:
>  
>  [root@ipaclient sssd]# id usera(a)bau.mydomain.at
>  id: usera(a)bau.mydomain.at: No such user
>  [root@ipaclient sssd]# id userb(a)bau.mydomain.at
>  id: userb(a)bau.mydomain.at: No such user
>  
>  Where do I have to take a closer look? 
Hi,

please check on the IPA server. What is the output of 'id
usera(a)bau.mydomain.at' on the IPA server when the client returns 'No
such user'?

Additionally please check the SSSD logs on the IPA server if there are
any issue looking up the user or any groups the user is a member of.

bye,
Sumit

>  
>  Cheers,
>  Ronald
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[Ronald Wimmer]

On 08.11.19 10:15, Sumit Bose via FreeIPA-users wrote:
>  On Fri, Nov 08, 2019 at 10:04:41AM +0100, Ronald Wimmer via
> FreeIPA-users wrote:
> > It seems that this was a coincidence... sometimes AD users are found but
> > most of the time they are not:
> >
> > [root@ipaclient sssd]# id usera(a)bau.mydomain.at
> > id: usera(a)bau.mydomain.at: No such user
> > [root@ipaclient sssd]# id userb(a)bau.mydomain.at
> > id: userb(a)bau.mydomain.at: No such user
> >
> > Where do I have to take a closer look?
>  
>  Hi,
>  
>  please check on the IPA server. What is the output of 'id
>  usera(a)bau.mydomain.at' on the IPA server when the client returns 'No
>  such user'? 
There is apparently no problem on the ipa servers themselves. id 
usera(a)bau.mydomain.at did work every time I tried...

>  Additionally please check the SSSD logs on the IPA server if there
> are
>  any issue looking up the user or any groups the user is a member of. 
In order to avoid an AD group problem I created an external group with 
the AD users as members (instead of putting an AD group there) and 
mapped that group to an IPA POSIX group.

Cheers,
Ronald

[Ronald Wimmer]

I think I know where to take a closer look.

I have 2 IPA servers, let's call them ipaA and ipaB. On ipaA everything 
works without any problems. On ipaB I cannot resolve AD users.

The "ipa trust-add" command has only been issued on ipaA. Some time ago 
I read about trust controllers and trust agents on 
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...

Are these assumptions true:
- ipaA became a trust controller by issuing the "ipa trust-add" command
- ipaB will have to be configured as trust agent

Cheers,
Ronald

[Alexander Bokovoy]

On pe, 08 marras 2019, Ronald Wimmer via FreeIPA-users wrote:
> I think I know where to take a closer look.
>
> I have 2 IPA servers, let's call them ipaA and ipaB. On ipaA 
> everything works without any problems. On ipaB I cannot resolve AD 
> users.
>
> The "ipa trust-add" command has only been issued on ipaA. Some time 
> ago I read about trust controllers and trust agents on
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>
> Are these assumptions true:
> - ipaA became a trust controller by issuing the "ipa trust-add" command
> - ipaB will have to be configured as trust agent 
Correct. By running ipa-adtrust-install --add-agents on ipaA, you can
add ipaB to the set of trust agents.


-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Ronald Wimmer]

On 08.11.19 11:08, Alexander Bokovoy via FreeIPA-users wrote:
>  [...]
> > Are these assumptions true:
> > - ipaA became a trust controller by issuing the "ipa trust-add" command
> > - ipaB will have to be configured as trust agent
>  
>  Correct. By running ipa-adtrust-install --add-agents on ipaA, you can
>  add ipaB to the set of trust agents. 
Thank you very much. Now I have a working setup.

Just two remaining questions...
1)
If I wanted another server to be a trust controller I would run 
"ipa-adtrust-install" on that server?

2)
In order to add all remaining IPA servers as a trust agent I could run 
"ipa-adtrust-install --add-agents" on any trust controller in my setup?

Cheers,
Ronald

[Alexander Bokovoy]

On pe, 08 marras 2019, Ronald Wimmer via FreeIPA-users wrote:
> On 08.11.19 11:08, Alexander Bokovoy via FreeIPA-users wrote:
> >[...]
> >>Are these assumptions true:
> >>- ipaA became a trust controller by issuing the "ipa trust-add" command
> >>- ipaB will have to be configured as trust agent
> >
> >Correct. By running ipa-adtrust-install --add-agents on ipaA, you can
> >add ipaB to the set of trust agents.
>
> Thank you very much. Now I have a working setup.
>
> Just two remaining questions...
> 1)
> If I wanted another server to be a trust controller I would run 
> "ipa-adtrust-install" on that server? 
Correct.

> 2)
> In order to add all remaining IPA servers as a trust agent I could run 
> "ipa-adtrust-install --add-agents" on any trust controller in my 
> setup? 
Correct.

One catch that is not fixed yet is promotion of the compat tree
configurations on trust agents. There is a need to update cn=config
entries to add special attributes. We do it in ipa-adtrust-install so
they are always correct on the trust controllers but since
ipa-adtrust-install isn't run on trust agents themselves, no changes
done to cn=config there. We need to solve this somehow, via some kind of
a remote call similar how replica connectivity check is done.

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Ben Aveling]

>  sshd[24003]: error: PAM: User not known to the underlying
> authentication module for illegal user  
I've occasionally had a similar problem.

The most recent time, it was only ssh that couldn't find the user.

'id user' worked, 'su user' worked, 'kinit user' worked.

Only 'ssh user@host' didn't work.

And then, even 'ssh user@host' worked.

I suspect, but can't prove, that it was an intermittent problem talking to the AD
server.

User's credentials are cached now, so totally not able to troubleshoot further.