I set up an Centos7 using sssd as authentication system. The user identies are provided by files (passwd/group, managed by ansible), auth is done via krb5 (provided by active directory).
The sssd.conf looks like this:
[sssd]
domains = OURADDOMAIN
services = nss, pam
[domain/OURADDOMAIN]
id_provider = files
auth_provider = krb5
krb5_server = our_domain_controller
krb5_realm = OURADDOMAIN
cache_credentials = true
[pam]
offline_credentials_expiration = 2
offline_failed_login_attempts = 3
offline_failed_login_delay = 5
This works fine online without problems, but when I disconnect the network, login fails. If login is ok, in /var/log/secure I see the following:
Apr 21 10:18:17 authtestel7 unix_chkpwd[11986]: password check failed for user (testuser)
Apr 21 10:18:17 authtestel7 login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost= user=testuser
Apr 21 10:18:17 authtestel7 login: pam_sss(login:auth): authentication success; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost= user=testuser
Apr 21 10:18:17 authtestel7 login: pam_unix(login:session): session opened for user testuser by LOGIN(uid=0)
Apr 21 10:18:17 authtestel7 login: LOGIN ON tty1 BY testuser
If login fails, it looks like this:
Apr 21 10:18:52 authtestel7 login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost= user=testuser
Apr 21 10:18:52 authtestel7 login: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost= user=testuser
Apr 21 10:18:52 authtestel7 login: pam_sss(login:auth): received for user testuser: 6 (Permission denied)
Apr 21 10:18:54 authtestel7 login: FAILED LOGIN 1 FROM tty1 FOR testuser, Authentication failure
When I set debug level to 4 in sssd.conf, I see the following line in sssd_pam.log:
(2021-04-21 10:18:52): [pam] [sysdb_cache_auth] (0x0100): Cached user entry is too old.
But the chache files are updated every time testuser logs in:
[root@authtestel7 ~]# ls -lrt /var/lib/sss/db/
insgesamt 8800
-rw-------. 1 root root 1286144 6. Apr 16:56 sssd.ldb
-rw-------. 1 root root 1609728 6. Apr 16:57 timestamps_files.ldb
-rw-------. 1 root root 1609728 6. Apr 16:57 cache_files.ldb
-rw-------. 1 root root 1286144 21. Apr 10:17 config.ldb
-rw-------. 1 root root 1609728 21. Apr 10:17 timestamps_OURDOMAIN.ldb
-rw-------. 1 root root 1609728 21. Apr 10:18 cache_OURDOMAIN.ldb
Any ideas whats wrong here?