We've been having trouble with users logging in to our Linux machines and the username part of their Kerberos principal being in uppercase. This is a disaster for the security policies on our Hadoop cluster which expects lowercase usernames.
Background is that we have CentOS 7.3 machines which are contacting a Windows AD.
I've found the circumstances under which this happens. I ssh into one of the Linux machines. I'm not using my SSH key so I have to enter my password. When I do this I get the username of the Kerberos principal in uppercase:
[root@machine1 ~]# ssh jasbre@machine2 jasbre@machine2's password: Last login: Mon Sep 18 12:06:13 2017 from machine1 [jasbre@machine ~]$ klist Ticket cache: FILE:/tmp/krb5cc_1379946670 Default principal: JASBRE@XXX.YYY.COM Valid starting Expires Service principal 09/18/2017 12:13:21 09/18/2017 22:13:21 krbtgt/XXX.YYY.COM@XXX.YYY.COM renew until 09/25/2017 12:13:21
Now I login with my SSH key and don't have a Kerberos ticket when I log in (since I haven't entered a password). I then do a kinit and I get the lowercase username in the principal:
[jasbre@machine2 ~]$ kinit Password for jasbre@XXX.YYY.COM: [jasbre@machine2 ~]$ klist Ticket cache: FILE:/tmp/krb5cc_1379946670 Default principal: jasbre@XXX.YYY.COM Valid starting Expires Service principal 09/18/2017 12:14:13 09/18/2017 22:14:13 krbtgt/XXX.YYY.COM@XXX.YYY.COM renew until 09/25/2017 12:14:07
What's going on here? I assume it is just something that I'm getting back from the domain controller. Can I somewhere steer this with my sssd.conf file on the Linux machine? I'm already have
case_sensitive = false in sssd.conf.