Cant get new TGT after kdestroy on gdm login with smartcard.

[Winberg, Adam]

I am having problems consistently getting a TGT after logging in via GDM
with smartcard. On first login it normally works, but if I do a 'kdestroy'
and then logout of my gnome session, I don't get a new TGT when I login to
a new session. Instead, the root user has a TGT for my AD user:

[a001329@c20693 ~]$ klist
klist: Credentials cache 'KCM:60483' not found

[root@c20693 ~]# klist
Ticket cache: KCM:0:63363
Default principal: a001329(a)EXAMPLE.COM

Valid starting       Expires              Service principal
2019-02-13 15:11:38  2019-02-14 01:11:33  krbtgt/EXAMPLE.com(a)EXAMPLE.com
    renew until 2019-02-20 15:11:33

A wild guess is that krb5-pkinit works by letting the root user get a TGT
for my user and then transfer that cache to my user, or something? In my
case that transfer does not happen if I previously performed a kdestroy.

From krb5_child.log:

(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]]
[sss_get_ccache_name_for_principal] (0x4000): Location: [KCM:]
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]]
[sss_get_ccache_name_for_principal] (0x4000): tmp_ccname: [KCM:0:71555]
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache]
(0x4000): Initializing ccache of type [KCM]
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache]
(0x4000): CC supports switch
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache]
(0x4000): returning: 0
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]]
[safe_remove_old_ccache_file] (0x0400): New and old ccache file are the
same, none will be deleted.
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [k5c_send_data]
(0x0200): Received error code 0
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]]
[pack_response_packet] (0x2000): response packet size: [95]
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [k5c_send_data]
(0x4000): Response sent.
(Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [main] (0x0400):
krb5_child completed successfully


After a while (not sure how long) it works as expected again, presumably
after a timeout of some sort.

If I disable KCM (by removing /etc/krb5.conf.d/kcm_default_ccache) TGT
retrieval works as expected. Am I missing something or is this a bug?


Regards,
Adam

[Sumit Bose]

On Wed, Feb 13, 2019 at 03:25:33PM +0100, Winberg, Adam wrote:
>  I am having problems consistently getting a TGT after logging in via
> GDM
>  with smartcard. On first login it normally works, but if I do a 'kdestroy'
>  and then logout of my gnome session, I don't get a new TGT when I login to
>  a new session. Instead, the root user has a TGT for my AD user:
>  
>  [a001329@c20693 ~]$ klist
>  klist: Credentials cache 'KCM:60483' not found
>  
>  [root@c20693 ~]# klist
>  Ticket cache: KCM:0:63363
>  Default principal: a001329(a)EXAMPLE.COM
>  
>  Valid starting       Expires              Service principal
>  2019-02-13 15:11:38  2019-02-14 01:11:33  krbtgt/EXAMPLE.com(a)EXAMPLE.com
>      renew until 2019-02-20 15:11:33
>  
>  A wild guess is that krb5-pkinit works by letting the root user get a TGT
>  for my user and then transfer that cache to my user, or something? In my
>  case that transfer does not happen if I previously performed a kdestroy.
>  
>  From krb5_child.log:
>  
>  (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]]
>  [sss_get_ccache_name_for_principal] (0x4000): Location: [KCM:]
>  (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]]
>  [sss_get_ccache_name_for_principal] (0x4000): tmp_ccname: [KCM:0:71555]
>  (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache]
>  (0x4000): Initializing ccache of type [KCM]
>  (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache]
>  (0x4000): CC supports switch
>  (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache]
>  (0x4000): returning: 0
>  (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]]
>  [safe_remove_old_ccache_file] (0x0400): New and old ccache file are the
>  same, none will be deleted.
>  (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [k5c_send_data]
>  (0x0200): Received error code 0
>  (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]]
>  [pack_response_packet] (0x2000): response packet size: [95]
>  (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [k5c_send_data]
>  (0x4000): Response sent.
>  (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [main] (0x0400):
>  krb5_child completed successfully
>  
>  
>  After a while (not sure how long) it works as expected again, presumably
>  after a timeout of some sort.
>  
>  If I disable KCM (by removing /etc/krb5.conf.d/kcm_default_ccache) TGT
>  retrieval works as expected. Am I missing something or is this a bug? 
I guess you hit https://pagure.io/SSSD/sssd/issue/3903 /
https://bugzilla.redhat.com/show_bug.cgi?id=1658813 fixed by
https://pagure.io/SSSD/sssd/c/e49e9f727e4960c8a0a2ed50488dac6e51ddf284?br....

HTH

bye,
Sumit

>  
>  
>  Regards,
>  Adam 
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...