On Wed, Feb 08, 2017 at 09:59:52AM +0100, Kees Bakker wrote:
> Hi,
>
> This is a follow-up on the problem I had with
> klist: Invalid UID in persistent keyring name while getting default ccache
> (See "How to enable krb5_child log" earlier this month.)
>
> The situation is that we have local users with the same name that exist in
> IPA,
> but the UIDs are different. We have this on several systems, and it is because
> we are in the process of setting up a FreeIPA server.
>
> Now (so far), on one system the environment variable KRB5CCNAME is set during
> login. (Login via display manager or console, does not matter. If logged via
> SSH
> then the variable is not set.)
>
> My question: where / how is that variable being set? I'd like to understand
> why
> this one system is different from the rest.
The variable is set by pam_sss.so during the authentication phase.
I suspect the difference might be in the PAM stack -- maybe on the
systems where KRB5CCNAME is not set, the PAM stack is configured using
pam_localuser.so so that if the username exists in /etc/passwd, only
pam_unix.so is tried?
>
> Other details: Ubuntu 16.04 (server and clients).
>
> BTW. The klist / kinit problem can easily be solved by unsetting that
> environment
> variable.
> --
> Kees
>
>
> --
> Manage your subscription for the Freeipa-users mailing list:
> https://www.redhat.com/mailman/listinfo/freeipa-users
> Go to http://freeipa.org for more info on the project
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project
