Issue #2851: Account expiration attributes are not honored unless replicated to GC - sssd

SSSD / sssd

#2851 Account expiration attributes are not honored unless replicated to GC

Closed: wontfix Mar 24, 2020 by pbrezina. Opened Oct 22, 2015 by simaofontes.

Have been trying to setup ssh key based authentication.
My authentication provider is Windows AD.

I have a user that has a public key in but has a expired account.

I try to login with the user and the ssh public key gets returned and the account is allowed.
When I logout and log back in the account is now denied with user account has expired. After a couple of seconds, about 5, the client is able to log back in again.

My expected result is that the user gets denied always because of the expired account.

In the logs it looks like the client is not going through the same path for the first time and the period after. The first time pam_unix(sshd:session) si active, the rest pam_sss(sshd:account) is being used.

Can you explain if this is an issue with my setup. I should never be able to login if my account is expired.

My sssd.conf:
[domain/AD]
id_provider = ad
auth_provider = ad
chpass_provider = ad
access_provider = ad
cache_credentials = true
ad_user_ssh_public_key = sshPublicKey

And ssh configuration is:
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
AuthorizedKeysCommandUser nobody
PasswordAuthentication no

Logs from secure:
Oct 22 16:40:47 SERVER_IP sshd[4861]: Accepted publickey for uexpired from CLIENT_IP port ssh2: RSA
Oct 22 16:40:47 SERVER_IP sshd[4861]: pam_unix(sshd:session): session opened for user uexpired by (uid=0)
Oct 22 16:40:48 SERVER_IP sshd[4866]: Received disconnect from CLIENT_IP: 11: disconnected by user
Oct 22 16:40:48 SERVER_IP sshd[4861]: pam_unix(sshd:session): session closed for user uexpired
Oct 22 16:40:49 SERVER_IP sshd[4892]: pam_sss(sshd:account): system info: [The user account is expired on the AD server]
Oct 22 16:40:49 SERVER_IP sshd[4892]: pam_sss(sshd:account): Access denied for user uexpired: 13 (User account has expired)
Oct 22 16:40:49 SERVER_IP sshd[4892]: fatal: Access denied for user uexpired by PAM account configuration [preauth]

sbose commented Oct 22, 2015

The domain and pam responder logs would be useful here.

Can you try to set 'ad_enable_gc = False' in the [domain/AD] section of sssd.conf and see if the user is then rejected more reliable?

simaofontes commented Oct 22, 2015

Replying to [comment:1 sbose]:

The domain and pam responder logs would be useful here.

Can you try to set 'ad_enable_gc = False' in the [domain/AD] section of sssd.conf and see if the user is then rejected more reliable?

Thank you for the tip. Will try and get back to you.

Can you specify the way to get pam logs please.

dpal commented Oct 22, 2015

Can you specify the way to get pam logs please.

https://fedorahosted.org/sssd/wiki/Troubleshooting

sbose commented Oct 23, 2015

Fields changed

cc: => sbose

simaofontes commented Oct 27, 2015

Hi,

Setting 'ad_enable_gc = False' in the [domain/AD] section of sssd.conf, cause the users to be correctly rejected. The manual section on this option is not clear, maybe get a bit of clarification on what it does and on how the sssd authenticates users for us to understand the option.

Thank you for the help

sbose commented Oct 28, 2015

If an account is expired or not can be determined by looking at the accountExpires attribute in the user's LDAP entry. See e.g. https://msdn.microsoft.com/en-us/library/ms675098%28v=vs.85%29.aspx for details about this attribute.

By default this attribute is not replicated to the user entry in the Global Catalog (GC). When using the AD provider SSSD uses a combination of LDAP and GC lookups to get the needed data for users and groups.

The intermittent behavior you are seeing might be due to the fact that after the user is looked up in the GC and the data is written to the cache of SSSD accountExpires data in the cache is removed because it is not available in the data returned by the GC. When setting 'ad_enable_gc = False' the GC lookups are disabled completely and the accountExpries data in the cache will not be removed anymore.

I think it would be a good idea to evaluate if SSSD can be more clever here and either disable the GC lookups automatically or make sure existing data is not removed after GC lookups.

jhrozek commented Oct 29, 2015

Do you think we should fix this issue on its own or wait until we can use S4U2Self?

sbose commented Oct 29, 2015

I think we should fix it on its own. The attribute is not part of the PAC and although I would expect that S4U2Self will fail on an expired account I'm not sure if we can detect the reason for the failure properly.

jhrozek commented Oct 29, 2015

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=1081046 (Red Hat Enterprise Linux 7)

rhbz: => [https://bugzilla.redhat.com/show_bug.cgi?id=1081046 1081046]

jhrozek commented Oct 29, 2015

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.14 alpha

jhrozek commented Feb 11, 2016

Fields changed

summary: Account expiration not working. => Account expiration attributes are not honored unless replicated to GC

jhrozek commented Feb 18, 2016

We need to change the PAC processing to happen in the back end first. Then we should re-test this ticket and see if it's still valid and what steps need to be taken further.

milestone: SSSD 1.14 alpha => SSSD 1.14 backlog

jhrozek commented Dec 15, 2016

Since the 1.14 branch is transitioning into maintenance mode and new functionality is being developed in master which will become 1.15 eventually, I'm mass-moving tickets from the 1.14 backlog milestone to the "Future releases" milestone.

milestone: SSSD 1.14 backlog => SSSD Future releases (no date set yet)

Metadata Update from @simaofontes:
- Issue set to the milestone: SSSD Future releases (no date set yet)

Feb 24, 2017

Metadata Update from @thalman:
- Custom field design_review reset (from 0)
- Custom field mark reset (from 0)
- Custom field patch reset (from 0)
- Custom field review reset (from 0)
- Custom field sensitive reset (from 0)
- Custom field testsupdated reset (from 0)
- Issue close_status updated to: None
- Issue tagged with: Canditate to close

Mar 13, 2020

pbrezina commented Mar 24, 2020

Thank you for taking time to submit this request for SSSD. Unfortunately this issue was not given priority and the team lacks the capacity to work on it at this time.

Given that we are unable to fulfill this request I am closing the issue as wontfix.

If the issue still persist on recent SSSD you can request re-consideration of this decision by reopening this issue. Please provide additional technical details about its importance to you.

Thank you for understanding.

Metadata Update from @pbrezina:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)

Mar 24, 2020

pbrezina commented May 2, 2020

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3892

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata

Assignee

None

Tags

Blocking

None

Depending on

None

Priority

Normal

type

defect

component

AD Provider

version

1.13.1

sensitive

false

testsupdated

false

patch

false

rhbz

https://bugzilla.redhat.com/show_bug.cgi?id=1081046

design_review

false

selected

None

review

false

mark

false

SSSD / sssd

#2851 Account expiration attributes are not honored unless replicated to GC Closed: wontfix Mar 24, 2020 by pbrezina. Opened Oct 22, 2015 by simaofontes.

Metadata

Candidate to close

#2851 Account expiration attributes are not honored unless replicated to GC

Closed: wontfix Mar 24, 2020 by pbrezina. Opened Oct 22, 2015 by simaofontes.