Actions
tickets #170152
openkanidm-unixd "Token was resolved by a provider that no longer appears to be present"
Start date:
2024-11-22
Due date:
% Done:
0%
Estimated time:
Description
Today I want to log in on tsp.i.o.o, SSH immediately fails with "Connection closed by 2a07:de40:b27e:1203::b20 port 22".
Opening a serial console, journalctl -f shows the following upon me attempting a SSH connection:
Nov 22 20:59:57 tsp kanidm_unixd[1204]: 00000000-0000-0000-0000-000000000000 ERROR 🚨 [error]: Token was resolved by a provider that no longer appears to be present. | provider: Ignore
Nov 22 20:59:57 tsp kanidm_unixd[1204]: 00000000-0000-0000-0000-000000000000 ERROR 🚨 [error]: Token was resolved by a provider that no longer appears to be present. | provider: Ignore
Nov 22 20:59:57 tsp kanidm_unixd[1204]: 00000000-0000-0000-0000-000000000000 ERROR 🚨 [error]: Token was resolved by a provider that no longer appears to be present. | provider: Ignore
Nov 22 20:59:57 tsp kanidm_unixd[1204]: 00000000-0000-0000-0000-000000000000 ERROR 🚨 [error]: Token was resolved by a provider that no longer appears to be present. | provider: Ignore
Nov 22 20:59:57 tsp kanidm_unixd[1204]: 00000000-0000-0000-0000-000000000000 ERROR 🚨 [error]: Token was resolved by a provider that no longer appears to be present. | provider: Ignore
Nov 22 20:59:57 tsp kanidm_unixd[1204]: 00000000-0000-0000-0000-000000000000 ERROR 🚨 [error]: Token was resolved by a provider that no longer appears to be present. | provider: Ignore
Nov 22 20:59:57 tsp sshd[11465]: fatal: Access denied for user crameleon by PAM account configuration [preauth]
Restarting kanidm-unixd does not help.
I'm not sure it is related to the previous tickets.
I enabled debug mode and it returns
[debug]: token -> Some(UserToken { provider: Ignore, name: "crameleon", spn: "crameleon@infra.opensuse.org", .....<lots more information from my account>
along with every one of the error messages. Let me know if I should upload all of it.
Updated by crameleon about 1 month ago
I found I can "repair" the affected machines by stopping the kanidm-unixd and kanidm-unixd-tasks services, deleting /var/cache/kanidm-unixd/kanidm.cache.db
, and starting the services again.
Updated by firstyear 27 days ago
https://github.com/kanidm/kanidm/pull/3256
Will be in 1.4.4
Actions