cache_credentials = true not working in sssd master

[joakim-tjernlund]

After a fresh install (complete machine) offline login does not work(after one initial login to cache pw)
However, after a few successful logins , it works to do offline logins again.

No logs I am afraid

[alexey-tikhonov]

After a fresh install (complete machine) offline login does not work(after one initial login to cache pw) However, after a few successful logins , it works to do offline logins again.

What you describe is controlled by cache_credentials.
How is krb5_store_password_if_offline relevant?

[joakim-tjernlund]

After a fresh install (complete machine) offline login does not work(after one initial login to cache pw) However, after a few successful logins , it works to do offline logins again.

What you describe is controlled by cache_credentials. How is krb5_store_password_if_offline relevant?

Sorry I meant cache_credentials = true

[alexey-tikhonov]

@danlavu, do we have a test for this scenario?

[joakim-tjernlund]

I went back to d0bfa08d8557e0a442b46202eba8e685b8a08093 but the problem is still there.
No idea when this was introduced. Any ideas?

[alexey-tikhonov]

after one initial login to cache pw

Could you please inspect (using ldbsearch) user record in the cache?

[alexey-tikhonov]

(Sanitized) logs would help the best.

[joakim-tjernlund]

Please specify what logs/loglevel and ldbsearch cmd to use

[alexey-tikhonov]

Logs - sssd_pam.log + sssd_$domain.log with debug_level=9

ldbsearch - something like:

# ldbsearch -H /var/lib/sss/db/cache_files.ldb name=pipewire@files
asq: Unable to register control with rootdse!
# record 1
dn: name=pipewire@files,cn=groups,cn=files,cn=sysdb
createTimestamp: 1747418234
gidNumber: 990
name: pipewire@files
objectCategory: group
nameAlias: pipewire@files
isPosix: TRUE
lastUpdate: 1747418234
dataExpireTimestamp: 1747423634
distinguishedName: name=pipewire@files,cn=groups,cn=files,cn=sysdb

# returned 1 records

If you don't provider any filter then ldbsearch will dump entire cache.

[joakim-tjernlund]

ldbsearch -H /var/lib/sss/db/cache_infinera.com.ldb name=jocke@infinera.com :

...
ccacheFile: KCM:
cachedPassword: $6$at2iRNP9/.GVcT.r$BxVHF6Mq3udw7B2C0EX5sZymKYY.pFd.i3Nwk2jpQt
 17uYLOt0xMuboEDkrAD3xdlkiKl1OTrrvEwlufVxcpw1
cachedPasswordType: 1
lastCachedPasswordChange: 1748361300
failedLoginAttempts: 0
lastOnlineAuth: 1748361300
lastOnlineAuthWithCurrentToken: 1748361300
lastLogin: 1748361300
distinguishedName: name=jocke@infinera.com,cn=users,cn=infinera.com,cn=sysdb

That look ok I think.
The PAM log does not

sssd_pam.log
sssd_infinera.com.log

[alexey-tikhonov]

How do you simulate offline status?

I think the problem is that 'sssd_be' doesn't "understand" that it is offline:

(2025-05-27 17:56:54): [be[infinera.com]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE
...
(2025-05-27 17:56:54): [be[infinera.com]] [be_resolve_server_process] (0x0200): [RID#7] Found address for server se-dc01.infinera.com: [10.210.34.21] TTL 3600
...
(2025-05-27 17:56:54): [be[infinera.com]] [krb5_auth_done] (0x3f7c0): [RID#7] The krb5_child process returned an error. Please inspect the krb5_child.log file or the journal for more information

and thus SSSD doesn't try to use password cache. It "sees" a different error.

[danlavu]

@danlavu, do we have a test for this scenario?

Multihost tests, yes. System tests, not yet.

[joakim-tjernlund]

How do you simulate offline status?

I think the problem is that 'sssd_be' doesn't "understand" that it is offline:

(2025-05-27 17:56:54): [be[infinera.com]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE
...
(2025-05-27 17:56:54): [be[infinera.com]] [be_resolve_server_process] (0x0200): [RID#7] Found address for server se-dc01.infinera.com: [10.210.34.21] TTL 3600
...
(2025-05-27 17:56:54): [be[infinera.com]] [krb5_auth_done] (0x3f7c0): [RID#7] The krb5_child process returned an error. Please inspect the krb5_child.log file or the journal for more information

and thus SSSD doesn't try to use password cache. It "sees" a different error.

I pull the LAN cable and then disable WiFi so that doesn't connect due to no LAN

[joakim-tjernlund]

krb5_child.log

[alexey-tikhonov]

Do you have a local DNS cache so that

Found address for server se-dc01.infinera.com: [10.210.34.21] TTL 3600

?

It's clear what happens - 'sssd_be' doesn't understand immediately that it is offline, so doesn't try to fallback to local auth using password hash.

When it does, offline logins should work.