New subject: [Bug 2379224] sssd-ad does not rotate machine account password

10 Jul 2025

      https://bugzilla.redhat.com/show_bug.cgi?id=2379224
Bug ID: 2379224
           Summary: sssd-ad does not rotate machine account password
           Product: Fedora
           Version: 42
          Hardware: x86_64
                OS: Linux
            Status: NEW
         Component: sssd
          Severity: high
          Assignee: sssd-maintainers@lists.fedoraproject.org
          Reporter: luca.cavana@cavanasystems.com
        QA Contact: extras-qa@fedoraproject.org
                CC: abokovoy@redhat.com, atikhono@redhat.com,
                    lslebodn@redhat.com, pbrezina@redhat.com,
                    sbose@redhat.com, ssorce@redhat.com,
                    sssd-maintainers@lists.fedoraproject.org
  Target Milestone: ---
    Classification: Fedora
Description of problem:
In a Fedora 42 machine joined to AD DS by sssd and realmd (Windows Server 2022
DCs with Server 2016 Functional Level), sssd fails to rotate the machine
account password, as dictated by:
ad_maximum_machine_account_password_age = 30 days (default configuration)
ad_machine_account_password_renewal_opts = 86400:750:300:realm (default
configuration)
Version-Release number of selected component (if applicable):
sssd-ad.x86_64                          2.11.0-1.fc42
realmd.x86_64                           0.17.1-15.fc42
How reproducible:
Always
Steps to Reproduce:
1. Install a Fedora 42 host, patch it and join to AD DS domain
2. Wait for the default 30 days of time to pass, or modify
ad_maximum_machine_account_password_age to shorter value
3. Monitor PasswordLastSet/msDS-KeyVersionNumber attributes in AD DS, they
never change
Actual results:
The password is never rotated.
Expected results:
The password is rotated.
Additional info:
In sssd_domain_name.log you can see sssd trying to rotate the password by
calling realm command and failing. Here is a snippet of my log:
*  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]]
[ad_machine_account_password_renewal_done] (0x1000): --- adcli output start---
 realm discover -v [realm-name]
   Discover available realm
realm join -v [-U user] realm-name
   Enroll this machine in a realm
realm leave -v [-U user] [realm-name]
   Unenroll this machine from a realm
realm list
   List known realms
realm permit [-ax] [-R realm] user ...
   Permit user logins
realm deny --all [-R realm]
   Deny user logins
---adcli output end---
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [be_ptask_done]
(0x0400): Task [AD machine account password renewal]: finished successfully
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [be_ptask_schedule]
(0x0400): Task [AD machine account password renewal]: scheduling task 60
seconds from last execution time [1752134253]
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x1000): Waiting for child [86188].
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86188] failed with status [2].
********************** BACKTRACE DUMP ENDS HERE
*********************************
(2025-07-10  9:57:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86192] failed with status [2].
   *  ... skipping repetitive backtrace ...
(2025-07-10  9:58:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86205] failed with status [2].
   *  ... skipping repetitive backtrace ...
(2025-07-10  9:59:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86211] failed with status [2].
   *  ... skipping repetitive backtrace ...
(2025-07-10 10:00:33): [be[corp.cavanasystems.com]] [child_sig_handler]
(0x0020): child [86218] failed with status [2].
   *  ... skipping repetitive backtrace ...
You can see it is calling the realm command to do the rotation but the latter
is returning like it is being called with the wrong parameters.
It is then retrying every minute because I've altered my configuration as such,
for debugging purposes:
ad_maximum_machine_account_password_age = 30
ad_machine_account_password_renewal_opts = 60:5
-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2379224

Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report...

[Bug 2379224] New: sssd-ad does not rotate machine account password