The dreaded 'system error' with Kerberos and sssd

After some LDAP-related experimentation I was unable to log in to my workstation, which uses sssd to implement a setup where the users are identified by LDAP and authenticated by Kerberos.

In the log (/var/log/messages) I was seeing messages like these:

login: FAILED LOGIN SESSION FROM tty3 FOR smithfarm, System error
pam_sss(login:auth): received for user smithfarm: 4 (System error)
pam_sss(xdm:auth): received for user smithfarm: 4 (System error)
sshd[6004]: error: PAM: System error for smithfarm from ws.farm.cz

This was mysterious. Since I knew it was Kerberos-related, I raised the debug level in the Kerberos section of the sssd configuration file /etc/sssd/sssd.conf:

[domain/default]
debug_level = 0x07F0
enumerate = false
id_provider = ldap
...

After restarting sssd and trying to login again, the sssd log file (/var/log/sssd/sssd_default.log on my system) had something interesting to say:

(Tue Jun 17 10:56:22 2014) [sssd[be[default]]] [cc_residual_is_used] (0x0200): Cache file [/tmp/krb5cc_17006_M5
1GxZ] does not exist, it will be recreated
(Tue Jun 17 10:56:22 2014) [sssd[be[default]]] [check_old_ccache] (0x0400): Saved ccache FILE:/tmp/krb5cc_17006
_M51GxZ doesn't exist.
(Tue Jun 17 10:56:22 2014) [sssd[be[default]]] [krb5_auth_send] (0x0200): Ignoring ccache attribute [FILE:/tmp/
krb5cc_17006_M51GxZ], because it doesn't exist.

17006 is the uid I always get when I login via LDAP/Kerberos. So I tried the following command:

# rm -rf /tmp/krb5cc_17006*

Then after restarting sssd I was able to log in.

LDAP reading list

• www.openldap.org
• LDAP for Rocket Scientists
• Authentication using LDAP (guide by Lance Rathbone, last modified in 2008 but still useful)
• Kerberos, GSSAPI and SASL Authentication using LDAP (a particularly useful section of Rathbone's guide)

openSUSE: How to set up an LDAP server

Read guides:

• https://help.ubuntu.com/12.10/serverguide/openldap-server.html

• First, make sure you have the following packages installed:

# rpm -qa | grep ldap
openldap2-client-2.4.31-2.1.3.x86_64
yast2-ldap-2.22.2-2.1.3.x86_64
yast2-ldap-server-2.22.2-2.1.3.x86_64
libldap-2_4-2-32bit-2.4.31-2.1.3.x86_64
libldap-2_4-2-2.4.31-2.1.3.x86_64
openldap2-devel-2.4.31-2.1.3.x86_64
openldap2-2.4.31-2.1.3.x86_64
libldapcpp1-0.3.0-8.1.2.x86_64
yast2-ldap-client-2.22.10-2.4.1.noarch
#

• Run YaST, go to "Network Services", choose "LDAP Server".
• In the left column, notice where it says "Databases", click on it.
• Now, the window section to the right displays info on the LDAP databases currently installed. Delete the "dc=example,dc=com" (or whatever it's called) database and Add your own.
• Write down your Administrator DN/password combination somewhere so you don't forget.
• Click "Next"
• Click "OK"

After you finish the above, you should be able to run the following command with similar results to these:

$ ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectclass=*)
# requesting: namingContexts 
#

#
dn:
namingContexts: o=smithfarm

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1
$

• Enjoy the openSUSE OpenLDAP goodness!