<div dir="ltr">Thanks, It is working for few user but not for every one. I have cleared the sssd cache as well.<div>=====================</div><div><div>/var/log/secure<br><br></div><div>Nov 16 14:06:39 ipa-clinet1 sshd[6852]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.213.0.134 user=kb1980</div><div>Nov 16 14:06:39 ipa-clinet1 sshd[6852]: pam_sss(sshd:auth): received for user kb1980: 6 (Permission denied)</div><div>Nov 16 14:06:39 ipa-clinet1 sshd[6852]: pam_winbind(sshd:auth): getting password (0x00000010)</div><div>Nov 16 14:06:39 ipa-clinet1 sshd[6852]: pam_winbind(sshd:auth): pam_get_item returned a password</div><div>Nov 16 14:06:39 ipa-clinet1 sshd[6852]: pam_winbind(sshd:auth): internal module error (retval = PAM_AUTHINFO_UNAVAIL(9), user = 'kb1980')</div><div>Nov 16 14:06:39 ipa-clinet1 sshd[6852]: Failed password for kb1980 from 146.213.0.134 port 51114 ssh2</div><div>Nov 16 14:06:48 ipa-clinet1 sshd[6852]: Connection closed by 146.213.0.134 [preauth]</div><div>Nov 16 14:07:07 ipa-clinet1 sshd[3677]: pam_unix(sshd:session): session closed for user kb1980</div><div><br></div><div>========================</div><div>krb5_child.log<br><br></div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [main] (0x0400): krb5_child started.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [unpack_buffer] (0x1000): total buffer size: [54]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [unpack_buffer] (0x0100): cmd [249] uid [1007628631] gid [1007628631] validate [true] enterprise principal [false] offline [true] UPN [karan.b@MYDOMAIN COM]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [main] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [become_user] (0x0200): Already user [1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [k5c_setup] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [main] (0x0400): Will perform pre-auth</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [tgt_req_child] (0x1000): Attempting to get a TGT</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [MYDOMAIN COM]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [sss_child_krb5_trace_cb] (0x4000): [6879] 1479301593.872554: Getting initial credentials for karan.b@MYDOMAIN COM</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [sss_child_krb5_trace_cb] (0x4000): [6879] 1479301593.874607: Sending request (167 bytes) to MYDOMAIN COM</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [sss_child_krb5_trace_cb] (0x4000): [6879] 1479301593.898179: Retrying AS request with master KDC</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [sss_child_krb5_trace_cb] (0x4000): [6879] 1479301593.898221: Getting initial credentials for karan.b@MYDOMAIN COM</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [sss_child_krb5_trace_cb] (0x4000): [6879] 1479301593.898291: Sending request (167 bytes) to MYDOMAIN COM (master)</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [get_and_save_tgt] (0x0400): krb5_get_init_creds_password returned [-1765328230} during pre-auth.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [k5c_send_data] (0x0200): Received error code 0</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [pack_response_packet] (0x2000): response packet size: [4]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [k5c_send_data] (0x4000): Response sent.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6879]]]] [main] (0x0400): krb5_child completed successfully</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [main] (0x0400): krb5_child started.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [unpack_buffer] (0x1000): total buffer size: [159]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [unpack_buffer] (0x0100): cmd [241] uid [1007628631] gid [1007628631] validate [true] enterprise principal [false] offline [true] UPN [karan.b@MYDOMAIN COM]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [unpack_buffer] (0x0100): ccname: [KEYRING:persistent:1007628631] old_ccname: [KEYRING:persistent:1007628631] keytab: [/etc/krb5.keytab]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [switch_creds] (0x0200): Switch user to [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [switch_creds] (0x0200): Switch user to [0][0].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [k5c_check_old_ccache] (0x4000): Ccache_file is [KEYRING:persistent:1007628631] and is not active and TGT is valid.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [main] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [become_user] (0x0200): Already user [1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [k5c_setup] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [main] (0x0400): Will perform offline auth</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [create_empty_ccache] (0x1000): Existing ccache still valid, reusing</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [k5c_send_data] (0x0200): Received error code 0</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [pack_response_packet] (0x2000): response packet size: [53]</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [k5c_send_data] (0x4000): Response sent.</div><div>(Wed Nov 16 14:06:33 2016) [[sssd[krb5_child[6880]]]] [main] (0x0400): krb5_child completed successfully</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [main] (0x0400): krb5_child started.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [unpack_buffer] (0x1000): total buffer size: [54]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [unpack_buffer] (0x0100): cmd [249] uid [1007628631] gid [1007628631] validate [true] enterprise principal [false] offline [true] UPN [karan.b@MYDOMAIN COM]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [main] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [become_user] (0x0200): Already user [1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [k5c_setup] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [main] (0x0400): Will perform pre-auth</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [tgt_req_child] (0x1000): Attempting to get a TGT</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [MYDOMAIN COM]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [sss_child_krb5_trace_cb] (0x4000): [6881] 1479301599.494908: Getting initial credentials for karan.b@MYDOMAIN COM</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [sss_child_krb5_trace_cb] (0x4000): [6881] 1479301599.496903: Sending request (167 bytes) to MYDOMAIN COM</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [sss_child_krb5_trace_cb] (0x4000): [6881] 1479301599.497962: Retrying AS request with master KDC</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [sss_child_krb5_trace_cb] (0x4000): [6881] 1479301599.497985: Getting initial credentials for karan.b@MYDOMAIN COM</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [sss_child_krb5_trace_cb] (0x4000): [6881] 1479301599.498026: Sending request (167 bytes) to MYDOMAIN COM (master)</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [get_and_save_tgt] (0x0400): krb5_get_init_creds_password returned [-1765328230} during pre-auth.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [k5c_send_data] (0x0200): Received error code 0</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [pack_response_packet] (0x2000): response packet size: [4]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [k5c_send_data] (0x4000): Response sent.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6881]]]] [main] (0x0400): krb5_child completed successfully</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [main] (0x0400): krb5_child started.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [unpack_buffer] (0x1000): total buffer size: [159]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [unpack_buffer] (0x0100): cmd [241] uid [1007628631] gid [1007628631] validate [true] enterprise principal [false] offline [true] UPN [karan.b@MYDOMAIN COM]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [unpack_buffer] (0x0100): ccname: [KEYRING:persistent:1007628631] old_ccname: [KEYRING:persistent:1007628631] keytab: [/etc/krb5.keytab]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [switch_creds] (0x0200): Switch user to [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [switch_creds] (0x0200): Switch user to [0][0].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [k5c_check_old_ccache] (0x4000): Ccache_file is [KEYRING:persistent:1007628631] and is not active and TGT is valid.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [main] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [become_user] (0x0200): Trying to become user [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [become_user] (0x0200): Already user [1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [k5c_setup] (0x2000): Running as [1007628631][1007628631].</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [main] (0x0400): Will perform offline auth</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [create_empty_ccache] (0x1000): Existing ccache still valid, reusing</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [k5c_send_data] (0x0200): Received error code 0</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [pack_response_packet] (0x2000): response packet size: [53]</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [k5c_send_data] (0x4000): Response sent.</div><div>(Wed Nov 16 14:06:39 2016) [[sssd[krb5_child[6882]]]] [main] (0x0400): krb5_child completed successfully</div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Nov 16, 2016 at 1:02 PM, <span dir="ltr"><<a href="mailto:freeipa-users-request@redhat.com" target="_blank">freeipa-users-request@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">Send Freeipa-users mailing list submissions to<br> <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br> <br> To subscribe or unsubscribe via the World Wide Web, visit<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/freeipa-users</a><br> or, via email, send a message with subject or body 'help' to<br> <a href="mailto:freeipa-users-request@redhat.com">freeipa-users-request@redhat.<wbr>com</a><br> <br> You can reach the person managing the list at<br> <a href="mailto:freeipa-users-owner@redhat.com">freeipa-users-owner@redhat.com</a><br> <br> When replying, please edit your Subject line so it is more specific<br> than "Re: Contents of Freeipa-users digest..."<br> <br> <br> Today's Topics:<br> <br> </span> 1. Client x.x.xx - RFC 1918 response from Internet in<br> /var/log/messages (Bjarne Blichfeldt)<br> 2. Re: pam_winbind(sshd:auth): pam_get_item returned a password<br> (Sumit Bose)<br> <br> <br> ------------------------------<wbr>------------------------------<wbr>----------<br> <br> Message: 1<br> Date: Wed, 16 Nov 2016 11:56:05 +0000<br> From: Bjarne Blichfeldt <<a href="mailto:BJB@jndata.dk">BJB@jndata.dk</a>><br> To: "<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>" <<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>><br> Subject: [Freeipa-users] Client x.x.xx - RFC 1918 response from<br> Internet in /var/log/messages<br> Message-ID:<br> <<a href="mailto:89213DDB84447F44A8E8950A5C2185E0482EB1EE@SJN01013.jnmain00.corp.jndata.net">89213DDB84447F44A8E8950A5C218<wbr>5E0482EB1EE@SJN01013.jnmain00.<wbr>corp.jndata.net</a>><br> <br> Content-Type: text/plain; charset="us-ascii"<br> <br> Just updated a couple of free-ipa servers to:<br> ipa-server-dns-4.4.0-12.el7.<wbr>noarch<br> redhat-release-server-7.3-7.<wbr>el7.x86_64<br> <br> Before the update, I resolved the issue with RFC messages by:<br> /etc/named.conf:<br> options {<br> disable-empty-zone "10.in-addr.arpa.";<br> :<br> <br> Now after the update the RFS messages has returned. I read in the changelog for 4.4 that this issue was resolved.<br> What did I miss?<br> <br> <br> <br> <br> <br> <br> Venlig hilsen<br> <br> <br> Bjarne Blichfeldt<br> <br> <br> Infrastructure Services<br> <br> <br> <br> Direkte +4563636119<br> <br> <br> Mobile +4521593270<br> <br> <br> <a href="mailto:BJB@jndata.dk">BJB@jndata.dk</a><br> <br> [cid:image005.png@01D24008.<wbr>CA6EF0F0]<br> <br> JN Data A/S<br> <br> *<br> <br> Havsteensvej 4<br> <br> *<br> <br> 4000 Roskilde<br> <br> <br> Telefon 63 63 63 63/ Fax 63 63 63 64<br> <br> <br> <a href="http://www.jndata.dk" rel="noreferrer" target="_blank">www.jndata.dk</a><br> <br> <br> [cid:image006.png@01D24008.<wbr>CA6EF0F0]<br> <span class="">-------------- next part --------------<br> An HTML attachment was scrubbed...<br> </span>URL: <<a href="https://www.redhat.com/archives/freeipa-users/attachments/20161116/46aeee39/attachment.html" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>archives/freeipa-users/<wbr>attachments/20161116/46aeee39/<wbr>attachment.html</a>><br> -------------- next part --------------<br> A non-text attachment was scrubbed...<br> Name: image005.png<br> Type: image/png<br> Size: 410 bytes<br> Desc: image005.png<br> URL: <<a href="https://www.redhat.com/archives/freeipa-users/attachments/20161116/46aeee39/attachment.png" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>archives/freeipa-users/<wbr>attachments/20161116/46aeee39/<wbr>attachment.png</a>><br> -------------- next part --------------<br> A non-text attachment was scrubbed...<br> Name: image006.png<br> Type: image/png<br> Size: 5487 bytes<br> Desc: image006.png<br> URL: <<a href="https://www.redhat.com/archives/freeipa-users/attachments/20161116/46aeee39/attachment-0001.png" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>archives/freeipa-users/<wbr>attachments/20161116/46aeee39/<wbr>attachment-0001.png</a>><br> <br> ------------------------------<br> <br> Message: 2<br> Date: Wed, 16 Nov 2016 13:01:59 +0100<br> From: Sumit Bose <<a href="mailto:sbose@redhat.com">sbose@redhat.com</a>><br> To: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br> Subject: Re: [Freeipa-users] pam_winbind(sshd:auth): pam_get_item<br> returned a password<br> Message-ID:<br> <20161116120159.GL28171@p.<wbr>Speedport_W_724V_Typ_A_<wbr>05011603_00_009><br> Content-Type: text/plain; charset=us-ascii<br> <span class=""><br> On Wed, Nov 16, 2016 at 12:49:59PM +0100, rajat gupta wrote:<br> > I am using FreeIPA version 4.4.0 Active Directory trust setup. And on<br> > Active Directory side I am using UPN suffix.<br> > Following are my domain setup.<br> ><br> > AD DOMANIN :- <a href="http://corp.addomain.com" rel="noreferrer" target="_blank">corp.addomain.com</a><br> > UPN suffix :- <a href="mailto:username@mydomain.com">username@mydomain.com</a><br> > IPA DOMAIN :- ipa.ipadomain.local<br> > IPA server hostname:- ilt-gif-ipa01.ipa.ipadomain.<wbr>local<br> <br> </span>When you call 'ipa trust-find' on the IPA server do you see the<br> <a href="http://mydomain.com" rel="noreferrer" target="_blank">mydomain.com</a> UPN suffix listed, like e.g.:<br> <br> # ipa trust-find<br> ---------------<br> 1 trust matched<br> ---------------<br> Realm-Name: ad.devel<br> Domain NetBIOS name: AD<br> Domain Security Identifier: S-1-5-21-3692237560-<wbr>1981608775-3610128199<br> Trust type: Active Directory domain<br> UPN suffixes: alt.alt, alt.upn.suffix<br> <br> SSSD 1.14 and above on the IPA client should enable enterprise principal<br> support automatically if UPN suffixes are found on the server but according to<br> <span class=""><br> (0x0100): cmd [241] uid [1007656917] gid [1007656917] validate [true] enterprise principal [false] offline [false] UPN [<a href="mailto:Rajat.Gupta@MYDOMAIN.COM">Rajat.Gupta@MYDOMAIN.COM</a>]<br> <br> </span>it is not. If the UPN suffixes are not know on the server, calling 'ipa<br> trust-fetch-domains' might help to get them. If there are still no UPN suffixes<br> available on the server you can switch on enterprise principal on the client<br> manually by adding 'krb5_use_enterprise_principal = True' in the [domain/...]<br> section of sssd.conf. You have to set it manually as well if you are using<br> older versions of SSSD.<br> <br> HTH<br> <br> bye,<br> Sumit<br> <div><div class="h5"><br> ><br> ><br> > I am able to login with AD user on IPA server. But on IPA clinet i am not<br> > able to login i am getting the login message "Access denied". I have<br> > enabled the debug_level on sssd.conf on ipa clinet.<br> ><br> > below are some logs..<br> > ================<br> > /var/log/secure<br> ><br> > Nov 16 09:00:52 ipa-clinet1 sshd[3752]: pam_sss(sshd:auth): authentication<br> > failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x user=rg1989<br> > Nov 16 09:00:52 ipa-clinet1 sshd[3752]: pam_sss(sshd:auth): received for<br> > user e600336: 6 (Permission denied)<br> > Nov 16 09:00:52 ipa-clinet1 sshd[3752]: pam_winbind(sshd:auth): getting<br> > password (0x00000010)<br> > Nov 16 09:00:52 ipa-clinet1 sshd[3752]: pam_winbind(sshd:auth):<br> > pam_get_item returned a password<br> > Nov 16 09:00:52 ipa-clinet1 sshd[3752]: pam_winbind(sshd:auth): internal<br> > module error (retval = PAM_AUTHINFO_UNAVAIL(9), user = 'rg1989')<br> > Nov 16 09:00:52 ipa-clinet1 sshd[3752]: Failed password for e600336 from<br> > x.x.x.x. port 48842 ssh2<br> > ================<br> ><br> > ================<br> > krb5_child.log<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4836]]]] [k5c_send_data]<br> > (0x4000): Response sent.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4836]]]] [main] (0x0400):<br> > krb5_child completed successfully<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [main] (0x0400):<br> > krb5_child started.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [unpack_buffer]<br> > (0x1000): total buffer size: [159]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [unpack_buffer]<br> > (0x0100): cmd [241] uid [1007656917] gid [1007656917] validate [true]<br> > enterprise principal [false] offline [false] UPN [<a href="mailto:Rajat.Gupta@MYDOMAIN.COM">Rajat.Gupta@MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [unpack_buffer]<br> > (0x0100): ccname: [KEYRING:persistent:<wbr>1007656917] old_ccname:<br> > [KEYRING:persistent:<wbr>1007656917] keytab: [/etc/krb5.keytab]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [switch_creds]<br> > (0x0200): Switch user to [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [switch_creds]<br> > (0x0200): Switch user to [0][0].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [k5c_check_old_ccache] (0x4000): Ccache_file is<br> > [KEYRING:persistent:<wbr>1007656917] and is not active and TGT is valid.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [k5c_precreate_ccache] (0x4000): Recreating ccache<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [k5c_setup_fast]<br> > (0x0100): SSSD_KRB5_FAST_PRINCIPAL is set to<br> > [host/ipa-clinet1.ipa.<wbr>ipadomain.local@IPA.IPADOMAIN.<wbr>LOCAL]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [find_principal_in_keytab] (0x4000): Trying to find principal<br> > host/ipa-clinet1.ipa.<wbr>ipadomain.local@IPA.IPADOMAIN.<wbr>LOCAL in keytab.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [match_principal]<br> > (0x1000): Principal matched to the sample<br> > (host/ipa-clinet1.ipa.<wbr>ipadomain.local@IPA.IPADOMAIN.<wbr>LOCAL).<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [check_fast_ccache]<br> > (0x0200): FAST TGT is still valid.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [main] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [k5c_setup] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME]<br> > from environment.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from<br> > environment.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to [true]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [main] (0x0400): Will<br> > perform online auth<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [tgt_req_child]<br> > (0x1000): Attempting to get a TGT<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [get_and_save_tgt]<br> > (0x0400): Attempting kinit for realm [<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.416687: Getting<br> > initial credentials for <a href="mailto:Rajat.Gupta@MYDOMAIN.COM">Rajat.Gupta@MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.418641: FAST armor<br> > ccache: MEMORY:/var/lib/sss/db/fast_<wbr>ccache_IPA.IPADOMAIN.LOCAL<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.418698: Retrieving<br> > host/ipa-clinet1.ipa.<wbr>ipadomain.local@IPA.IPADOMAIN.<wbr>LOCAL -><br> > krb5_ccache_conf_data/fast_<wbr>avail/krbtgt\/<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a><br> > \@MYDOMAIN.COM@X-CACHECONF: from<br> > MEMORY:/var/lib/sss/db/fast_<wbr>ccache_IPA.IPADOMAIN.LOCAL with result:<br> > -1765328243/Matching credential not found<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.418756: Sending<br> > request (164 bytes) to <a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.419718: Retrying AS<br> > request with master KDC<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.419752: Getting<br> > initial credentials for <a href="mailto:Rajat.Gupta@MYDOMAIN.COM">Rajat.Gupta@MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.419778: FAST armor<br> > ccache: MEMORY:/var/lib/sss/db/fast_<wbr>ccache_IPA.IPADOMAIN.LOCAL<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.419821: Retrieving<br> > host/ipa-clinet1.ipa.<wbr>ipadomain.local@IPA.IPADOMAIN.<wbr>LOCAL -><br> > krb5_ccache_conf_data/fast_<wbr>avail/krbtgt\/<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a><br> > \@MYDOMAIN.COM@X-CACHECONF: from<br> > MEMORY:/var/lib/sss/db/fast_<wbr>ccache_IPA.IPADOMAIN.LOCAL with result:<br> > -1765328243/Matching credential not found<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4837] 1479283764.419859: Sending<br> > request (164 bytes) to <a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a> (master)<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [get_and_save_tgt]<br> > (0x0020): 1296: [-1765328230][Cannot find KDC for realm "<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a>"]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [map_krb5_error]<br> > (0x0020): 1365: [-1765328230][Cannot find KDC for realm "<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a>"]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [k5c_send_data]<br> > (0x0200): Received error code 1432158228<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]]<br> > [pack_response_packet] (0x2000): response packet size: [4]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [k5c_send_data]<br> > (0x4000): Response sent.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4837]]]] [main] (0x0400):<br> > krb5_child completed successfully<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [main] (0x0400):<br> > krb5_child started.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [unpack_buffer]<br> > (0x1000): total buffer size: [159]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [unpack_buffer]<br> > (0x0100): cmd [241] uid [1007656917] gid [1007656917] validate [true]<br> > enterprise principal [false] offline [false] UPN [<a href="mailto:Rajat.Gupta@MYDOMAIN.COM">Rajat.Gupta@MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [unpack_buffer]<br> > (0x0100): ccname: [KEYRING:persistent:<wbr>1007656917] old_ccname:<br> > [KEYRING:persistent:<wbr>1007656917] keytab: [/etc/krb5.keytab]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [switch_creds]<br> > (0x0200): Switch user to [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [switch_creds]<br> > (0x0200): Switch user to [0][0].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [k5c_check_old_ccache] (0x4000): Ccache_file is<br> > [KEYRING:persistent:<wbr>1007656917] and is not active and TGT is valid.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [k5c_precreate_ccache] (0x4000): Recreating ccache<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [k5c_setup_fast]<br> > (0x0100): SSSD_KRB5_FAST_PRINCIPAL is set to<br> > [host/ipa-clinet1.ipa.<wbr>ipadomain.local@IPA.IPADOMAIN.<wbr>LOCAL]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [find_principal_in_keytab] (0x4000): Trying to find principal<br> > host/ipa-clinet1.ipa.<wbr>ipadomain.local@IPA.IPADOMAIN.<wbr>LOCAL in keytab.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [match_principal]<br> > (0x1000): Principal matched to the sample<br> > (host/ipa-clinet1.ipa.<wbr>ipadomain.local@IPA.IPADOMAIN.<wbr>LOCAL).<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [check_fast_ccache]<br> > (0x0200): FAST TGT is still valid.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [main] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [k5c_setup] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME]<br> > from environment.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from<br> > environment.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to [true]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [main] (0x0400): Will<br> > perform online auth<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [tgt_req_child]<br> > (0x1000): Attempting to get a TGT<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [get_and_save_tgt]<br> > (0x0400): Attempting kinit for realm [<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.426870: Getting<br> > initial credentials for <a href="mailto:Rajat.Gupta@MYDOMAIN.COM">Rajat.Gupta@MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.428706: FAST armor<br> > ccache: MEMORY:/var/lib/sss/db/fast_<wbr>ccache_IPA.IPADOMAIN.LOCAL<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.428762: Retrieving<br> > host/ipa-clinet1.ipa.<wbr>ipadomain.local@IPA.IPADOMAIN.<wbr>LOCAL -><br> > krb5_ccache_conf_data/fast_<wbr>avail/krbtgt\/<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a><br> > \@MYDOMAIN.COM@X-CACHECONF: from<br> > MEMORY:/var/lib/sss/db/fast_<wbr>ccache_IPA.IPADOMAIN.LOCAL with result:<br> > -1765328243/Matching credential not found<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.428825: Sending<br> > request (164 bytes) to <a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.429706: Retrying AS<br> > request with master KDC<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.429740: Getting<br> > initial credentials for <a href="mailto:Rajat.Gupta@MYDOMAIN.COM">Rajat.Gupta@MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.429767: FAST armor<br> > ccache: MEMORY:/var/lib/sss/db/fast_<wbr>ccache_IPA.IPADOMAIN.LOCAL<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.429812: Retrieving<br> > host/ipa-clinet1.ipa.<wbr>ipadomain.local@IPA.IPADOMAIN.<wbr>LOCAL -><br> > krb5_ccache_conf_data/fast_<wbr>avail/krbtgt\/<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a><br> > \@MYDOMAIN.COM@X-CACHECONF: from<br> > MEMORY:/var/lib/sss/db/fast_<wbr>ccache_IPA.IPADOMAIN.LOCAL with result:<br> > -1765328243/Matching credential not found<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4838] 1479283764.429854: Sending<br> > request (164 bytes) to <a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a> (master)<br> ><br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [get_and_save_tgt]<br> > (0x0020): 1296: [-1765328230][Cannot find KDC for realm "<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a>"]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [map_krb5_error]<br> > (0x0020): 1365: [-1765328230][Cannot find KDC for realm "<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a>"]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [k5c_send_data]<br> > (0x0200): Received error code 1432158228<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]]<br> > [pack_response_packet] (0x2000): response packet size: [4]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [k5c_send_data]<br> > (0x4000): Response sent.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4838]]]] [main] (0x0400):<br> > krb5_child completed successfully<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [main] (0x0400):<br> > krb5_child started.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [unpack_buffer]<br> > (0x1000): total buffer size: [159]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [unpack_buffer]<br> > (0x0100): cmd [241] uid [1007656917] gid [1007656917] validate [true]<br> > enterprise principal [false] offline [true] UPN [<a href="mailto:Rajat.Gupta@MYDOMAIN.COM">Rajat.Gupta@MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [unpack_buffer]<br> > (0x0100): ccname: [KEYRING:persistent:<wbr>1007656917] old_ccname:<br> > [KEYRING:persistent:<wbr>1007656917] keytab: [/etc/krb5.keytab]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [switch_creds]<br> > (0x0200): Switch user to [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]]<br> > [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [switch_creds]<br> > (0x0200): Switch user to [0][0].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]]<br> > [k5c_check_old_ccache] (0x4000): Ccache_file is<br> > [KEYRING:persistent:<wbr>1007656917] and is not active and TGT is valid.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [main] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [become_user]<br> > (0x0200): Already user [1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [k5c_setup] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME]<br> > from environment.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from<br> > environment.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [main] (0x0400): Will<br> > perform offline auth<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [create_empty_ccache]<br> > (0x1000): Existing ccache still valid, reusing<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [k5c_send_data]<br> > (0x0200): Received error code 0<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]]<br> > [pack_response_packet] (0x2000): response packet size: [53]<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [k5c_send_data]<br> > (0x4000): Response sent.<br> > (Wed Nov 16 09:09:24 2016) [[sssd[krb5_child[4839]]]] [main] (0x0400):<br> > krb5_child completed successfully<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [main] (0x0400):<br> > krb5_child started.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [unpack_buffer]<br> > (0x1000): total buffer size: [52]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [unpack_buffer]<br> > (0x0100): cmd [249] uid [1007656917] gid [1007656917] validate [true]<br> > enterprise principal [false] offline [true] UPN [<a href="mailto:Rajat.Gupta@MYDOMAIN.COM">Rajat.Gupta@MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [main] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [become_user]<br> > (0x0200): Already user [1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [k5c_setup] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME]<br> > from environment.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from<br> > environment.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [main] (0x0400): Will<br> > perform pre-auth<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [tgt_req_child]<br> > (0x1000): Attempting to get a TGT<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [get_and_save_tgt]<br> > (0x0400): Attempting kinit for realm [<a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4840] 1479283767.766694: Getting<br> > initial credentials for <a href="mailto:Rajat.Gupta@MYDOMAIN.COM">Rajat.Gupta@MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4840] 1479283767.769074: Sending<br> > request (164 bytes) to <a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4840] 1479283767.770020: Retrying AS<br> > request with master KDC<br> ><br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4840] 1479283767.770051: Getting<br> > initial credentials for <a href="mailto:Rajat.Gupta@MYDOMAIN.COM">Rajat.Gupta@MYDOMAIN.COM</a><br> ><br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [sss_child_krb5_trace_cb] (0x4000): [4840] 1479283767.770091: Sending<br> > request (164 bytes) to <a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a> (master)<br> ><br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [get_and_save_tgt]<br> > (0x0400): krb5_get_init_creds_password returned [-1765328230} during<br> > pre-auth.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [k5c_send_data]<br> > (0x0200): Received error code 0<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]]<br> > [pack_response_packet] (0x2000): response packet size: [4]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [k5c_send_data]<br> > (0x4000): Response sent.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4840]]]] [main] (0x0400):<br> > krb5_child completed successfully<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [main] (0x0400):<br> > krb5_child started.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [unpack_buffer]<br> > (0x1000): total buffer size: [160]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [unpack_buffer]<br> > (0x0100): cmd [241] uid [1007656917] gid [1007656917] validate [true]<br> > enterprise principal [false] offline [true] UPN [<a href="mailto:Rajat.Gupta@MYDOMAIN.COM">Rajat.Gupta@MYDOMAIN.COM</a>]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [unpack_buffer]<br> > (0x0100): ccname: [KEYRING:persistent:<wbr>1007656917] old_ccname:<br> > [KEYRING:persistent:<wbr>1007656917] keytab: [/etc/krb5.keytab]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [switch_creds]<br> > (0x0200): Switch user to [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]]<br> > [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [switch_creds]<br> > (0x0200): Switch user to [0][0].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]]<br> > [k5c_check_old_ccache] (0x4000): Ccache_file is<br> > [KEYRING:persistent:<wbr>1007656917] and is not active and TGT is valid.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [main] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [become_user]<br> > (0x0200): Trying to become user [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [become_user]<br> > (0x0200): Already user [1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [k5c_setup] (0x2000):<br> > Running as [1007656917][1007656917].<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME]<br> > from environment.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]]<br> > [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from<br> > environment.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [main] (0x0400): Will<br> > perform offline auth<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [create_empty_ccache]<br> > (0x1000): Existing ccache still valid, reusing<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [k5c_send_data]<br> > (0x0200): Received error code 0<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]]<br> > [pack_response_packet] (0x2000): response packet size: [53]<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [k5c_send_data]<br> > (0x4000): Response sent.<br> > (Wed Nov 16 09:09:27 2016) [[sssd[krb5_child[4841]]]] [main] (0x0400):<br> > krb5_child completed successfully<br> ><br> > =======================<br> > Can you please help me to fix this,<br> <br> > --<br> </div></div>> Manage your subscription for the Freeipa-users mailing list:<br> > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/freeipa-users</a><br> > Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> <div class="HOEnZb"><div class="h5"><br> <br> <br> ------------------------------<br> <br> ______________________________<wbr>_________________<br> Freeipa-users mailing list<br> <a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/freeipa-users</a><br> <br> End of Freeipa-users Digest, Vol 100, Issue 48<br> ******************************<wbr>****************<br> </div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><b>Rajat Gupta<br> </b><b><img style="margin:0pt 0.2ex;vertical-align:middle" src="http://../1/e/330"></b></div></div> </div>