[Bug 2095228] New: sssd_krb5 2.7.1 crashes "PAC check failed"

https://bugzilla.redhat.com/show_bug.cgi?id=2095228

            Bug ID: 2095228
           Summary: sssd_krb5 2.7.1 crashes "PAC check failed"
           Product: Fedora
           Version: 36
          Hardware: x86_64
                OS: Linux
            Status: NEW
         Component: sssd
          Assignee: sssd-maintainers(a)lists.fedoraproject.org
          Reporter: seanmottles(a)posteo.net
        QA Contact: extras-qa(a)fedoraproject.org
                CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
                    jhrozek(a)redhat.com, lslebodn(a)redhat.com,
                    luk.claes(a)gmail.com, mzidek(a)redhat.com,
                    pbrezina(a)redhat.com, sbose(a)redhat.com,
                    ssorce(a)redhat.com,
                    sssd-maintainers(a)lists.fedoraproject.org
  Target Milestone: ---
    Classification: Fedora



Created attachment 1888304
  --> https://bugzilla.redhat.com/attachment.cgi?id=1888304&action=edit
sssd krb5 log file

Description of problem:
Attempting to authenticate via password on Fedora 36 host connected to FreeIPA
with sssd 2.7.1-1 fails. ID lookups still function as normal.


Version-Release number of selected component (if applicable):
sssd-2.7.1-1.fc36

How reproducible:
Every attempt.

Steps to Reproduce:
1. Connect host to FreeIPA
2. Attempt to auth FreeIPA user via password
3.

Actual results:
"System Error" in /var/log/secure, and "PAC check failed for
principal" in
/var/log/sssd/krb5_child.log


Expected results:
Password auth is functional

Additional info:
Downgrading sssd to 2.7.0 resolves the issue and users can login as normal.


-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2095228

[Bug 2095228] sssd_krb5 2.7.1 crashes "PAC check failed"

https://bugzilla.redhat.com/show_bug.cgi?id=2095228

Iker Pedrosa <ipedrosa(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |DUPLICATE
             Status|NEW                         |CLOSED
                 CC|                            |ipedrosa(a)redhat.com
           Doc Type|---                         |If docs needed, set a value
        Last Closed|                            |2022-06-09 10:54:24



--- Comment #1 from Iker Pedrosa <ipedrosa(a)redhat.com&gt; ---
As a work-around set

    pac_check = check_upn, check_upn_dns_info_ex

in the [pac] section of sssd.conf.

*** This bug has been marked as a duplicate of bug 2094685 ***


-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2095228