[Sssd-maintainers] [Bug 1910169] New: sssd-kcm causing periodic auth failures after 2.4.0-2

https://bugzilla.redhat.com/show_bug.cgi?id=1910169

            Bug ID: 1910169
           Summary: sssd-kcm causing periodic auth failures after 2.4.0-2
           Product: Fedora
           Version: 33
            Status: NEW
         Component: sssd
          Assignee: sssd-maintainers(a)lists.fedoraproject.org
          Reporter: rwf(a)loonybin.net
        QA Contact: extras-qa(a)fedoraproject.org
                CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
                    jhrozek(a)redhat.com, lslebodn(a)redhat.com,
                    mzidek(a)redhat.com, pbrezina(a)redhat.com,
                    rharwood(a)redhat.com, sbose(a)redhat.com,
                    ssorce(a)redhat.com,
                    sssd-maintainers(a)lists.fedoraproject.org
  Target Milestone: ---
    Classification: Fedora



sssd-kcm is causing periodic auth failures on builds newer than 2.4.0-2,
presumably due to an issue introduced with the (surprising number of) patches
applied in 2.4.0-3.  (Incidentally, CPU usage by the process has gotten
substantially worse in these versions, as well.)

This manifests as all plaintext auth failing on Fedora 33 systems running sssd
2.4.0-4, joined to a FreeIPA domain and authenticating domain users, which will
emit errors like the following examples for the lifetime of the sssd-kcm
process that incurred the problem:

Dec 22 17:59:11 fedora33 systemd[1]: Starting SSSD Kerberos Cache Manager...
Dec 22 17:59:11 fedora33 systemd[1]: Started SSSD Kerberos Cache Manager.
Dec 22 17:59:11 fedora33 audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd-kcm
comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=?
terminal=?
res=success'
Dec 22 17:59:11 fedora33 kcm[10556]: Starting up
Dec 22 17:59:11 fedora33 krb5_child[10554][10554]: Generic error (see e-text)
Dec 22 17:59:11 fedora33 krb5_child[10554][10554]: Generic error (see e-text)
Dec 22 17:59:11 fedora33 auth[10552]: pam_sss(dovecot:auth): authentication
failure; logname= uid=97 euid=97 tty=dovecot ruser=rob rhost=2001:db8::1
user=rob
Dec 22 17:59:11 fedora33 auth[10552]: pam_sss(dovecot:auth): received for user
rob: 4 (System error)
Dec 22 17:59:19 fedora33 krb5_child[10559][10559]: Generic error (see e-text)
Dec 22 17:59:19 fedora33 krb5_child[10559][10559]: Generic error (see e-text)
Dec 22 17:59:19 fedora33 auth[10552]: pam_sss(dovecot:auth): authentication
failure; logname= uid=97 euid=97 tty=dovecot ruser=rob rhost=2001:db8::1
user=rob
Dec 22 17:59:19 fedora33 auth[10552]: pam_sss(dovecot:auth): received for user
rob: 4 (System error)
Dec 22 17:59:29 fedora33 krb5_child[10562][10562]: Generic error (see e-text)
Dec 22 17:59:29 fedora33 krb5_child[10562][10562]: Generic error (see e-text)
Dec 22 17:59:29 fedora33 auth[10552]: pam_sss(dovecot:auth): authentication
failure; logname= uid=97 euid=97 tty=dovecot ruser=rob rhost=2001:db8::1
user=rob
Dec 22 17:59:29 fedora33 auth[10552]: pam_sss(dovecot:auth): received for user
rob: 4 (System error)


Nothing else is logged anywhere.  Also affected are sudo and the like, but not
any authentication using Kerberos tickets.  Relatively short-lived workarounds
include waiting it out (sssd-kcm process exits, next auth attempt spawns a new
one and succeeds) or rebooting the host.  klist as affected users during these
events reports no KCM cache for the respective UID available, and kinit also
usually fails with the same 'Generic error' text until the sssd-kcm process
goes away.  Downgrading sssd* packages to 2.4.0-2 restores correct behavior.


-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.