Applies to: 

Versions of Centrify DirectControl <5.3.0 in all environments housing Windows 2012 DCs with SID Compression enabled


Problem:

After introducing Windows 2012 Domain Controllers into the environment with SID compression enabled, cross-trust users are unable to login. This may be observed through seemingly "missing" group or computer memberships.

Entries similar to the following may be observed within the logs:

Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > dns.findkdc KDC locator for DEMO.L2.OCEAN.NET
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > network.state Got favorite dc from kset:vcdc03.demo.l2.ocean.net for serviceType:KDC
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > network.state NST: SniffList: postfailsort=vcdc03.demo.l2.ocean.net
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > network.state SaveDC: domain=demo.l2.ocean.net, server=vcdc03.demo.l2.ocean.net serviceType:KDC
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.aduser Credentials passed spoofing test.
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Resource Domain SID: S-4-0.
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=21, attribute=0x3137F283
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=1553096506, attribute=0xE8380E7C
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=9, attribute=0x000AB45D
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=536870919, attribute=0x000CC30B
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=536870919, attribute=0x00099362
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=536870919, attribute=0x000C4DB4
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=536870919, attribute=0x000A5867
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=536870919, attribute=0x0009CAA3
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=536870919, attribute=0x000A430

The following entry may also be observed in the output when running 'adquery user' against an impacted account:

..
Unexpected error from /usr/share/centrifydc/libexec/adquery: SID is Null​


Cause:

This issue only occurs under some circumstances where there is an unexpected extra 4-byte offset in the PAC variable buffer that adclient does not normally account for. This throws off all subsequent offset calculations when the PAC (SID compressed) is parsed and presents a yield of broken/incomplete data. This results in missing group memberships and ultimately failed user logins caused by these missing memberships.  


Workaround:

Disabling SID compression on all 2012 DCs in the environment can alleviate this behavior, however this is not recommended as a permanent solution.


Resolution:

This issue has been resolved in Centrify Suite 2016 (5.3.0)
 
Release notes: https://docs.centrify.com/en/css/suite2016/DirectControl-Release-Notes.html

"Due to an error when parsing PAC (Privilege Attribute Certificate) that has SID compressed in the resource group field, zoned users are not able to login and adquery reports NULL SID for these users. The issue is fixed. (Ref: CSSUP-6606, CS-36209)"