Project

General

Profile

Actions

tickets #170152

open

kanidm-unixd "Token was resolved by a provider that no longer appears to be present"

Added by crameleon about 1 month ago. Updated 27 days ago.

Status:
New
Priority:
Normal
Assignee:
Category:
FreeIPA/Kanidm
Target version:
-
Start date:
2024-11-22
Due date:
% Done:

0%

Estimated time:

Description

Today I want to log in on tsp.i.o.o, SSH immediately fails with "Connection closed by 2a07:de40:b27e:1203::b20 port 22".

Opening a serial console, journalctl -f shows the following upon me attempting a SSH connection:

Nov 22 20:59:57 tsp kanidm_unixd[1204]: 00000000-0000-0000-0000-000000000000 ERROR    🚨 [error]: Token was resolved by a provider that no longer appears to be present. | provider: Ignore
Nov 22 20:59:57 tsp kanidm_unixd[1204]: 00000000-0000-0000-0000-000000000000 ERROR    🚨 [error]: Token was resolved by a provider that no longer appears to be present. | provider: Ignore
Nov 22 20:59:57 tsp kanidm_unixd[1204]: 00000000-0000-0000-0000-000000000000 ERROR    🚨 [error]: Token was resolved by a provider that no longer appears to be present. | provider: Ignore
Nov 22 20:59:57 tsp kanidm_unixd[1204]: 00000000-0000-0000-0000-000000000000 ERROR    🚨 [error]: Token was resolved by a provider that no longer appears to be present. | provider: Ignore
Nov 22 20:59:57 tsp kanidm_unixd[1204]: 00000000-0000-0000-0000-000000000000 ERROR    🚨 [error]: Token was resolved by a provider that no longer appears to be present. | provider: Ignore
Nov 22 20:59:57 tsp kanidm_unixd[1204]: 00000000-0000-0000-0000-000000000000 ERROR    🚨 [error]: Token was resolved by a provider that no longer appears to be present. | provider: Ignore
Nov 22 20:59:57 tsp sshd[11465]: fatal: Access denied for user crameleon by PAM account configuration [preauth]

Restarting kanidm-unixd does not help.

I'm not sure it is related to the previous tickets.

I enabled debug mode and it returns

 [debug]: token -> Some(UserToken { provider: Ignore, name: "crameleon", spn: "crameleon@infra.opensuse.org", .....<lots more information from my account>

along with every one of the error messages. Let me know if I should upload all of it.

Actions #1

Updated by crameleon about 1 month ago

  • Private changed from Yes to No
Actions #2

Updated by crameleon about 1 month ago

  • Description updated (diff)
Actions #3

Updated by crameleon about 1 month ago

I found I can "repair" the affected machines by stopping the kanidm-unixd and kanidm-unixd-tasks services, deleting /var/cache/kanidm-unixd/kanidm.cache.db, and starting the services again.

Actions

Also available in: Atom PDF