Created attachment 18812 [details] Config and log files When using ccache type KCM, with the credential manager provided by sssd-kcm, winbind does not succeed with kerberos auth and falls back to SAM logon. Setup is with a real Windows Server Active Directory domain. When the exact config is used except with a FILE ccache type, the kerberos authentication succeeds and the ccache is created. Checking the logs on the domain controller, shows that the authentication actually succeeds and a TGT is created, but this is not reflected on the member server: ``` A Kerberos authentication ticket (TGT) was requested. Account Information: Account Name: david Supplied Realm Name: AD.FILLINGHAM.AU User ID: FILLINGHAM\david MSDS-SupportedEncryptionTypes: 0x27 (DES, RC4, AES-Sk) Available Keys: AES-SHA1, RC4 Service Information: Service Name: krbtgt Service ID: FILLINGHAM\krbtgt MSDS-SupportedEncryptionTypes: 0x1F (DES, RC4, AES128-SHA96, AES256-SHA96) Available Keys: AES-SHA1, RC4 Domain Controller Information: MSDS-SupportedEncryptionTypes: 0x1F (DES, RC4, AES128-SHA96, AES256-SHA96) Available Keys: AES-SHA1, RC4 Network Information: Client Address: ::ffff:192.168.1.198 Client Port: 38146 Advertized Etypes: AES256-CTS-HMAC-SHA1-96 AES128-CTS-HMAC-SHA1-96 RC4-HMAC-NT Additional Information: Ticket Options: 0x40810000 Result Code: 0x0 Ticket Encryption Type: 0x12 Session Encryption Type: 0x12 Pre-Authentication Type: 2 Pre-Authentication EncryptionType: 0x12 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Ticket information Response ticket hash: ofAYf1Gjv4Xh6kvCFhxg3a6ZoNDhHHhZ/HbyhJQolu8= Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. ``` Doing a kinit interactively on the machine succeeds and populates the KCM ccache: ``` david@archvm:~$ kinit Password for david@AD.FILLINGHAM.AU: david@archvm:~$ klist Ticket cache: KCM:66639 Default principal: david@AD.FILLINGHAM.AU Valid starting Expires Service principal 29/01/26 22:11:39 30/01/26 08:11:39 krbtgt/AD.FILLINGHAM.AU@AD.FILLINGHAM.AU renew until 30/01/26 22:11:36 david@archvm:~$ kdestroy david@archvm:~$ klist klist: Credentials cache 'KCM:66639' not found ``` smb.conf, krb5.conf, pam_winbind.conf and wb.log-FILLINGHAM attached