Applies to:
Centrify DirectControl 5.4.0 and 5.4.1
Problem:
The command:
# su - <username>
has traditionally caused a new user's home directory to be created. The adclient from Centrify Server Suite 2017 does not create the home directory for a new user.
Cause:
The problem is due to a side-effect of another issue that was resolved with Suite 2017 where, under certain circumstances, a kerberos TGT (Ticket Granting Ticket) for a user, is kept in transient cache memory and can inadvertently be regenerated by the root account.
Workaround:
1) As root, open the file /etc/centrifydc/centrifydc.conf .
2) Add this parameter without any value, exactly as shown below.
adclient.create.krb5.creds.prog.blacklist:
3) Save the file.
4) Reload adclient.
# adreload
5) Test by running the command:
# su - <username>
and ensure the home directory is successfully created.
Note: This workaround will allow the home directory to be created just as in prior versions, but it also reintroduces the TGT issue detailed above.
Resolution:
This issue is fixed in Centrify DirectControl Suite 2017.2 (5.4.2)