2

I log in to Ubuntu 18.04 successfully with kerberos/sssd authentification in an ActiveDirectory domain. Since a few days I have an issue using my kerberos ticket/credentials cache to auth with some server shares.

If i call klist my credentials cache is displayed with start and expire date 01.01.1970. I believe that this causes my issue. After removing /tmp/krb5cc-file and authenticating with kinit again the start and expire date is correct and auth against server shares work like expected.

Do you know about known issues causing this behaviour? Or any hints how to solve this without double authenticate?

Some of my colleagues are working with 18.04 too but without any issues.

Best regards Patrick

5
  • Could this be your "issue"? bugs.launchpad.net/ubuntu/+source/sssd/+bug/1039151 Dec 20, 2018 at 9:59
  • Thanks. I checked this. But this seems to be another bug. Regardless how long I wait for login expire dates are always wrong. So it seems that my issue is not a network related bug. During testing I recognised that if I turn off password caching I am not able to login any more... Dec 21, 2018 at 11:45
  • But maybe an sssd related one? Have you tried without support for offline login? Dec 21, 2018 at 11:48
  • I identified the issue. Seems that something was wrong with my computer account stored in Active Directory. In my case strangely it was missing. Added it with net ads join now everything works like expected. Thanks for your support! Dec 21, 2018 at 12:03
  • you can answer.your own question then if you like Dec 21, 2018 at 12:29

2 Answers 2

0

I identified the issue. Seems that something was wrong with my computer account stored in Active Directory. In my case strangely it was missing. Added it with net ads join now everything works like expected. Thanks for your support!

0

I had a similar issue with my local Single Sign-On environment (not AD but OpenLDAP + MIT Kerberos) after I re-installed Ubuntu 18.04. For me, configuring sssd to automatically renew tickets resolved the issue. I just had to add the following lines to sssd.conf and restart the sssd service.

[domain/MY_REALM_NAME]
...
krb5_lifetime = 7d
krb5_renewable_lifetime = 7d
krb5_renew_interval = 30m
...

https://serverfault.com/a/133631/86462 also has some interesting details about how ticket lifetimes are computed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .