Indeed, the sssd change was introduced in 92697d4673f3663a00e087815ccc9534d7cf2c58 to default to realm for the machine password change, exactly because sssd can run as a non-root user.
commit 92697d4673f3663a00e087815ccc9534d7cf2c58 Author: Sumit Bose <[email protected]> Date: Mon Jan 13 20:19:05 2025 +0100 ad: use realm renew for keytab renewal Currently SSSD is using adcli to refresh a keytab. Sine adcli is directly started by an SSSD process this process must have the permissions/capabilities to update the keytab file. With SSSD running as unprivileged user the attempt to update the keytab might fail. With this patch SSSD can use the realm command as well to update the keytab which will send the request to the realmd daemon which has permissions to update the keytab. :config: New optional fourth value for AD provider configuration option ad_machine_account_password_renewal_opts to select the command to update the keytab, currently 'adcli' and 'realm' are allowed values We should update src:realmd ** Also affects: realmd (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172750 Title: sssd fails to renew machine account password To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/realmd/+bug/2172750/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
