** Description changed:
Steps to reproduce:
- Setup Smartcard authentication with Kerberos,
- In '/etc/krb5.conf' file, setup the use of KCM to store Kerberos tickets
with the option 'default_ccache_name = KCM:' (instead of
'KEYRING:persistent:%{uid}').
What's happening?
- After login through GDM, the 'KRB5CCNAME' is set to
'KEYRING:persistent:<my-uid>'.
What's expected?
- After login through GDM, the 'KRB5CCNAME' is set to `KCM:`.
Problem induced:
- As explained in the doc
https://web.mit.edu/kerberos/www/krb5-latest/doc/basic/ccache_def.html, this
environment variable supersede the configuration property set in the
'kerb5.conf`. Therefore, every command ('kinit' or 'sssctl' ones) use the conf
brought by the environment variable and set the Kerberos ticket in the Kernel
keyring instead of KCM.
Workaround:
- The only solution is to unset this variable before launching any Kerberos
ticket negotiation process.
+ Affected version: Ubuntu 24.04.4 LTS
+
Further information:
-I have checked that I have no other mention of this cache name configuration
in any other configuration file,
- I have also checked that no file in '/etc', '/var' or '~' was referring to
'KRB5CCNAME'.
- I checked the process tree and it's the `gnome-session` process which get
this env variable set to this value,
- I can join my 'sssd.conf' and 'krb5.conf' files if needed.
Suspected origin:
- I suspect a bug in the `pam_sss` module of `sssd` but have found nothing
upstream. I have also checked the code of the module, but it's not completely
clear where this variable is set (maybe here
https://github.com/SSSD/sssd/blob/master/src/providers/krb5/krb5_child.c#L1912).
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2165733
Title:
KRB5CCNAME environment variable set to wrong value
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/2165733/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
