Mathieu Baudier kirjoitti 21.4.2023 klo 7.19:
Package: freeipa-client
Version: 4.9.11-1
Severity: normal
Dear Maintainer,
on a host enrolled as an IPA client, Kerberos is not usable in Java.
The error message is:
KrbException: krb5.conf loading failed
(please find simple steps to reproduce below)
After debugging step by step, I found out that this is due to the fact
that the following Kerberos configuration directory
/var/lib/sss/pubconf/krb5.include.d/
ends up being included twice and that Java rejects multiple includes of the
same directory.
This directory is included:
- in the configuration file /etc/krb5.conf.d/enable_sssd_conf_dir
which is deployed by the installation of the *package* freeipa-client
(probably indirectly by one of the sssd packages?)
- in the configuration file /etc/krb5.conf
which is generated by the ipa-client-install procedure
As a workaround, commenting out the includedir line in
/etc/krb5.conf.d/enable_sssd_conf_dir
(or completely removing this file, since it contains only this line)
solves the problem.
Please note that:
- the issue occurs with Java 17, 11 and 21 (and most likely other available
Java versions)
- the issue does NOT occur on bullseye with freeipa-client from backports
(which we have been using in production for a while)
In order to reproduce (on a host enrolled as an IPA client), using the standard
Java JAAS Kerberos example:
https://docs.oracle.com/en/java/javase/17/security/jaas-authentication.html
(just copy JaasAcn.java and jaas.conf in the same directory; no need to compile)
$ /usr/lib/jvm/java-17-openjdk-amd64/bin/java
-Djava.security.auth.login.config=jaas.conf JaasAcn.java
Kerberos username [mbaudier]:
Authentication failed:
KrbException: krb5.conf loading failed
And the workaround:
$ sudo mv /etc/krb5.conf.d/enable_sssd_conf_dir /tmp
$ /usr/lib/jvm/java-17-openjdk-amd64/bin/java
-Djava.security.auth.login.config=jaas.conf JaasAcn.java
Kerberos username [mbaudier]:
Kerberos password for mbaudier:
Authentication succeeded!
Hi,
Okay, so it got added to sssd due to
https://github.com/SSSD/sssd/issues/5893
so I wonder if ipa should stop doing the same, and remove the line from
krb5.conf on upgrade.
--
t
