December 2025 - Sssd-maintainers - Fedora mailing-lists

[Bug 2417703] Cannot login with IPA account when freeipa-client is bundled in bootc image
by bugzilla＠redhat.com 02 Dec '25

02 Dec '25

https://bugzilla.redhat.com/show_bug.cgi?id=2417703 --- Comment #14 from Alexey Tikhonov <atikhono(a)redhat.com> --- (In reply to Alexander Bokovoy from comment #13) > So yes, this is the same issue as it was in > https://github.com/ostreedev/ostree-rs-ext/issues/654 which was supposed to > be fixed with https://github.com/ostreedev/ostree-rs-ext/pull/679. Actually this looks different. ostree-rs-ext/issues/654 was about lost file capabilities. In this case it's wrong ownership. -- You are receiving this mail because: You are the assignee for the bug. You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2417703 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 0

[Bug 2417703] Cannot login with IPA account when freeipa-client is bundled in bootc image
by bugzilla＠redhat.com 02 Dec '25

02 Dec '25

https://bugzilla.redhat.com/show_bug.cgi?id=2417703 --- Comment #13 from Alexander Bokovoy <abokovoy(a)redhat.com> --- So yes, this is the same issue as it was in https://github.com/ostreedev/ostree-rs-ext/issues/654 which was supposed to be fixed with https://github.com/ostreedev/ostree-rs-ext/pull/679. -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2417703 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 0

[Bug 2417703] Cannot login with IPA account when freeipa-client is bundled in bootc image
by bugzilla＠redhat.com 02 Dec '25

02 Dec '25

https://bugzilla.redhat.com/show_bug.cgi?id=2417703 --- Comment #12 from Alexey Tikhonov <atikhono(a)redhat.com> --- The reason is: ``` -rwxr-x---. 1 root root system_u:object_r:sssd_selinux_manager_exec_t:s0 36K 1 janv. 1970 selinux_child ``` -- 'sssd_be' run under 'sssd' user can't execute `selinux_child`. It should be ':sssd' owned, as other privileged helpers (`krb5_child`, `ldap_child`, `sssd_pam`) spec-file installs it properly - as 'root:sssd': https://src.fedoraproject.org/rpms/sssd/blob/rawhide/f/sssd.spec#_801 I guess the problem is that you add it later: ``` RUN dnf install -y freeipa-client ``` but not sure yet what exactly is broken so that it ends up with a wrong ownership. -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2417703 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 0

[Bug 2417703] Cannot login with IPA account when freeipa-client is bundled in bootc image
by bugzilla＠redhat.com 02 Dec '25

02 Dec '25

https://bugzilla.redhat.com/show_bug.cgi?id=2417703 William Oprandi <william.oprandi(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(william.oprandi@g | |mail.com) | --- Comment #11 from William Oprandi <william.oprandi(a)gmail.com> --- $ ls -lahZ /usr/libexec/sssd/ total 2,5M drwxr-xr-x. 2 root root system_u:object_r:bin_t:s0 442 1 janv. 1970 . drwxr-xr-x. 53 root root system_u:object_r:bin_t:s0 8,0K 1 janv. 1970 .. -rwxr-x---. 1 root sssd system_u:object_r:bin_t:s0 137K 1 janv. 1970 krb5_child -rwxr-x---. 1 root sssd system_u:object_r:bin_t:s0 48K 1 janv. 1970 ldap_child -rwxr-xr-x. 1 root root system_u:object_r:ipa_otpd_exec_t:s0 60K 1 janv. 1970 oidc_child -rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 72K 1 janv. 1970 p11_child -rwxr-xr-x. 1 root root system_u:object_r:ipa_otpd_exec_t:s0 56K 1 janv. 1970 passkey_child -rwxr-x---. 1 root root system_u:object_r:sssd_selinux_manager_exec_t:s0 36K 1 janv. 1970 selinux_child -rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 73 1 janv. 1970 sss_analyze -rwxr-xr-x. 1 root root system_u:object_r:sssd_exec_t:s0 179K 1 janv. 1970 sssd_autofs -rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 248K 1 janv. 1970 sssd_be -rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 16K 1 janv. 1970 sssd_check_socket_activated_responders -rwxr-xr-x. 1 root root system_u:object_r:sssd_exec_t:s0 276K 1 janv. 1970 sssd_ifp -rwxr-xr-x. 1 root root system_u:object_r:sssd_exec_t:s0 211K 1 janv. 1970 sssd_kcm -rwxr-xr-x. 1 root root system_u:object_r:sssd_exec_t:s0 253K 1 janv. 1970 sssd_nss -rwxr-xr-x. 1 root root system_u:object_r:sssd_exec_t:s0 183K 1 janv. 1970 sssd_pac -rwxr-x---. 1 root sssd system_u:object_r:sssd_exec_t:s0 280K 1 janv. 1970 sssd_pam -rwxr-xr-x. 1 root root system_u:object_r:sssd_exec_t:s0 187K 1 janv. 1970 sssd_ssh -rwxr-xr-x. 1 root root system_u:object_r:sssd_exec_t:s0 187K 1 janv. 1970 sssd_sudo -rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 12K 1 janv. 1970 sss_signal $ getcap /usr/libexec/sssd/* /usr/libexec/sssd/krb5_child cap_dac_read_search,cap_setgid,cap_setuid=p /usr/libexec/sssd/ldap_child cap_dac_read_search=p /usr/libexec/sssd/selinux_child cap_setgid,cap_setuid=p /usr/libexec/sssd/sssd_pam cap_dac_read_search=p -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2417703 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 0

[Bug 2417703] Cannot login with IPA account when freeipa-client is bundled in bootc image
by bugzilla＠redhat.com 02 Dec '25

02 Dec '25

https://bugzilla.redhat.com/show_bug.cgi?id=2417703 Alexey Tikhonov <atikhono(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(william.oprandi@g | |mail.com) -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2417703

1 0

[Bug 2417703] Cannot login with IPA account when freeipa-client is bundled in bootc image
by bugzilla＠redhat.com 02 Dec '25

02 Dec '25

https://bugzilla.redhat.com/show_bug.cgi?id=2417703 --- Comment #10 from Alexey Tikhonov <atikhono(a)redhat.com> --- Hi, could you please show output of ``` ls -lahZ /usr/libexec/sssd/ getcap /usr/libexec/sssd/* ``` ? -- You are receiving this mail because: You are the assignee for the bug. You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2417703 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 0

[Bug 2417703] Cannot login with IPA account when freeipa-client is bundled in bootc image
by bugzilla＠redhat.com 02 Dec '25

02 Dec '25

https://bugzilla.redhat.com/show_bug.cgi?id=2417703 Alexander Bokovoy <abokovoy(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|ipa-maint(a)redhat.com |sssd-maintainers(a)lists.fedo | |raproject.org CC| |atikhono(a)redhat.com, | |lslebodn(a)redhat.com, | |pbrezina(a)redhat.com, | |sbose(a)redhat.com, | |sssd-maintainers(a)lists.fedo | |raproject.org Component|freeipa |sssd --- Comment #9 from Alexander Bokovoy <abokovoy(a)redhat.com> --- Thanks. I'm moving this bug to SSSD so that they can analyze what's happening. -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2417703 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 0

[Bug 2351336] New: /etc/krb5.conf.d/enable_sssd_conf_dir is mistakenly in package sssd-krb5, not in sssd-krb5-common
by bugzilla＠redhat.com 02 Dec '25

02 Dec '25

https://bugzilla.redhat.com/show_bug.cgi?id=2351336 Bug ID: 2351336 Summary: /etc/krb5.conf.d/enable_sssd_conf_dir is mistakenly in package sssd-krb5, not in sssd-krb5-common Product: Fedora Version: 41 Hardware: x86_64 OS: Linux Status: NEW Component: sssd Severity: medium Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: hey(a)runiq.de QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora I have used realmd to join a host to an Active Directory domain. Realmd uses sssd-ad for this, which pulls in sssd-krb5-common but _not_ sssd-krb5. Unfortunately, sssd-krb5-common does not install the snippet /etc/krb5.conf.d/enable_sssd_conf_dir. This results in SSH refusing gssapi-with-mic authentication. When I additionally install the sssd-krb5 package (which includes the snippet), or create the snippet manually, SSH logins use my SSSD config and GSSAPI authentication goes through. Reproducible: Always Steps to Reproduce: 1. Install realmd on a host 2. Join host to Active Directory domain 3. Enable SSH daemon 4. ssh -l user@realm -o preferredauthentications=gssapi-with-mic host Actual Results: Authentication is denied, no SSH session opened Expected Results: Authentication goes through, SSH session is opened -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2351336 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 7

[Bug 2325893] New: sssd gpo_child doesn't have sufficient rights to populate GPO policies
by bugzilla＠redhat.com 02 Dec '25

02 Dec '25

https://bugzilla.redhat.com/show_bug.cgi?id=2325893 Bug ID: 2325893 Summary: sssd gpo_child doesn't have sufficient rights to populate GPO policies Product: Fedora Version: 41 Hardware: x86_64 OS: Linux Status: NEW Component: sssd Keywords: CommonBugs, Desktop Severity: medium Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: nekopilot(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora # 1. Issue After upgrade from F39 to F41 via UI path the login to the system with AD account is not possible. Local account works well. # 2. Workaround sssd service works under sssd user in Fedora 41. The folder with GPO policies has wrong rights with owner root: ls -lah /var/lib/sss/gpo_cache/example.com/Policies/ total 0 drwx------. 4 root root 98 Jan 10 2024 . drwx------. 3 sssd sssd 22 Jan 10 2024 .. drwx------. 3 root root 36 Nov 13 07:33 {31B2F332-016D-11D2-945F-00C04FBB84F9} drwx------. 3 root root 36 Nov 13 07:33 {7E50761D-1E4D-4D2B-BD86-E667EED3DF1E} It is possible to change the owner of the directories. After that the login with AD account works well. chown -R sssd:sssd /var/lib/sss/gpo_cache Reproducible: Always Steps to Reproduce: 1. Your F39 system must be joined to AD with sssd and you can login to the system with AD account. 2. Upgrade from F39 to F41. 3. Try to login with AD account. Actual Results: Login from Gnome UI is not possible with error: "Wrong user name or password". Expected Results: You can login to the system with AD account. Your F39 system must be joined to AD with sssd and you can login to the system with AD account. After upgrade you can't login from UI with AD account but: 1. kinit user.name(a)example.com - works well. 1. id user.name(a)example.com - works well. 1. realm list - looks good. In logs you can find error message: cat /var/log/sssd/gpo_child.log ``` [gpo_child[4066]] [prepare_gpo_cache] (0x0020): [RID#23] mkdir(/var/lib/sss/gpo_cache/example.com/Policies/{31B2F332-016D-11D2-945F-… failed: 13 ``` -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2325893 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

2026

2025

2024

2023

2022

2021

2020

Sssd-maintainers December 2025