[Sssd-maintainers] [Bug 2379224] New: sssd-ad does not rotate machine account password

https://bugzilla.redhat.com/show_bug.cgi?id=2379224

Bug ID: 2379224
           Summary: sssd-ad does not rotate machine account password
           Product: Fedora
           Version: 42
          Hardware: x86_64
                OS: Linux
            Status: NEW
         Component: sssd
          Severity: high
          Assignee: [e-mail]
          Reporter: [e-mail]
        QA Contact: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail]
  Target Milestone: ---
    Classification: Fedora

Description of problem:
In a Fedora 42 machine joined to AD DS by sssd and realmd (Windows Server 2022
DCs with Server 2016 Functional Level), sssd fails to rotate the machine
account password, as dictated by:
ad_maximum_machine_account_password_age = 30 days (default configuration)
ad_machine_account_password_renewal_opts = 86400:750:300:realm (default
configuration)

Version-Release number of selected component (if applicable):
sssd-ad.x86_64                          2.11.0-1.fc42
realmd.x86_64                           0.17.1-15.fc42

How reproducible:
Always

Steps to Reproduce:
1. Install a Fedora 42 host, patch it and join to AD DS domain
2. Wait for the default 30 days of time to pass, or modify
ad_maximum_machine_account_password_age to shorter value
3. Monitor PasswordLastSet/msDS-KeyVersionNumber attributes in AD DS, they
never change

Actual results:
The password is never rotated.

Expected results:
The password is rotated.

Additional info:
In sssd_domain_name.log you can see sssd trying to rotate the password by
calling realm command and failing. Here is a snippet of my log:

*  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]]
[ad_machine_account_password_renewal_done] (0x1000): --- adcli output start---
 realm discover -v [realm-name]
   Discover available realm

realm join -v [-U user] realm-name
   Enroll this machine in a realm

realm leave -v [-U user] [realm-name]
   Unenroll this machine from a realm

realm list
   List known realms

realm permit [-ax] [-R realm] user ...
   Permit user logins

realm deny --all [-R realm]
   Deny user logins
---adcli output end---
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [be_ptask_done]
(0x0400): Task [AD machine account password renewal]: finished successfully
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [be_ptask_schedule]
(0x0400): Task [AD machine account password renewal]: scheduling task 60
seconds from last execution time [1752134253]
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x1000): Waiting for child [86188].
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86188] failed with status [2].
********************** BACKTRACE DUMP ENDS HERE
*********************************

(2025-07-10  9:57:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86192] failed with status [2].
   *  ... skipping repetitive backtrace ...
(2025-07-10  9:58:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86205] failed with status [2].
   *  ... skipping repetitive backtrace ...
(2025-07-10  9:59:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86211] failed with status [2].
   *  ... skipping repetitive backtrace ...
(2025-07-10 10:00:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86218] failed with status [2].
   *  ... skipping repetitive backtrace ...

You can see it is calling the realm command to do the rotation but the latter
is returning like it is being called with the wrong parameters.
It is then retrying every minute because I've altered my configuration as such,
for debugging purposes:
ad_maximum_machine_account_password_age = 30
ad_machine_account_password_renewal_opts = 60:5