[SSSD-users]Curiosity question about sssd with a Kerberos/LDAP or AD back-end

[Spike White]

All,

We notice that when sssd-kcm service is messed up and not running, password
auth fails.  Interestingly, Kerberos (GSSAPI auth still succeeds.  Why?

So I know why password auth fails.  In /etc/krb5.conf.d/kcm_default_cache,
it has:

[libdefaults]

default_ccache_name = KCM:

So in password auth, it is failing on the step of writing the Kerberos
credential cache into the credentials store (KCM).  I speculate that it’s
specifically pam_sss.so in the auth phase that’s failing to do this.

You can see this failure on the command line:

[admspike_white@austgcore23 ~]$ kinit [e-mail]
kinit: Connection refused while getting default ccache

I understand why password auth fails.  My question is – why does Kerberos
(GSSAPI) auth succeed?

My guess is that sshd handles GSSAPI auth internally and never calls the
PAM stack in the “auth” phase.  Only for the “account” and  “session”
phase.  Thus pam_sss.so never gets invoked for the auth phase.

Spike