After introducing Windows 2012 Domain Controllers into the environment with SID compression enabled, cross-trust users are unable to login. This may be observed through seemingly "missing" group or computer memberships.
Applies to:
Versions of Centrify DirectControl <5.3.0 in all environments housing Windows 2012 DCs with SID Compression enabled
Problem:
After introducing Windows 2012 Domain Controllers into the environment with SID compression enabled, cross-trust users are unable to login. This may be observed through seemingly "missing" group or computer memberships.
Entries similar to the following may be observed within the logs:
Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > dns.findkdc KDC locator for DEMO.L2.OCEAN.NET Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > network.state Got favorite dc from kset:vcdc03.demo.l2.ocean.net for serviceType:KDC Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > network.state NST: SniffList: postfailsort=vcdc03.demo.l2.ocean.net Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > network.state SaveDC: domain=demo.l2.ocean.net, server=vcdc03.demo.l2.ocean.net serviceType:KDC Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.aduser Credentials passed spoofing test. Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Resource Domain SID: S-4-0. Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=21, attribute=0x3137F283 Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=1553096506, attribute=0xE8380E7C Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=9, attribute=0x000AB45D Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=536870919, attribute=0x000CC30B Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=536870919, attribute=0x00099362 Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=536870919, attribute=0x000C4DB4 Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=536870919, attribute=0x000A5867 Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=536870919, attribute=0x0009CAA3 Jan 22 11:46:38 lab01 adclient[30313]: DEBUG <fd:25 PAMVerifyPassword > base.pac Group rid=536870919, attribute=0x000A430
The following entry may also be observed in the output when running 'adquery user' against an impacted account:
.. Unexpected error from /usr/share/centrifydc/libexec/adquery: SID is Null
Cause:
This issue only occurs under some circumstances where there is an unexpected extra 4-byte offset in the PAC variable buffer that adclient does not normally account for. This throws off all subsequent offset calculations when the PAC (SID compressed) is parsed and presents a yield of broken/incomplete data. This results in missing group memberships and ultimately failed user logins caused by these missing memberships.
Workaround:
Disabling SID compression on all 2012 DCs in the environment can alleviate this behavior, however this is not recommended as a permanent solution.
Resolution:
This issue has been resolved in Centrify Suite 2016 (5.3.0)
"Due to an error when parsing PAC (Privilege Attribute Certificate) that has SID compressed in the resource group field, zoned users are not able to login and adquery reports NULL SID for these users. The issue is fixed. (Ref: CSSUP-6606, CS-36209)"