Editing Tornedo.tetrain.com Upgrade Plan (section)

=== 8.10 IMPORTANT finding during pre-cutover validation — missing SIDs broke auth for 59 users ===

Client tested logging into <code><nowiki>ipa.tetrain.com</nowiki></code>'s web UI as a real user (<code><nowiki>biswajit</nowiki></code>) — succeeded on <code><nowiki>tornedo.tetrain.com</nowiki></code>, '''failed''' on <code><nowiki>ipa.tetrain.com</nowiki></code> with the same password. Root cause, confirmed via <code><nowiki>krb5kdc.log</nowiki></code>: <code><nowiki>admin</nowiki></code>'s AS-REQ goes <code><nowiki>NEEDED_PREAUTH</nowiki></code> → <code><nowiki>ISSUE</nowiki></code> (clean); a normal user's goes <code><nowiki>NEEDED_PREAUTH</nowiki></code> → <code><nowiki>HANDLE_AUTHDATA: ... No such file or directory</nowiki></code> — fails during PAC generation, not password verification (this is NOT a <code><nowiki>PREAUTH_FAILED</nowiki></code>/wrong-password error).

Traced to exactly the warning <code><nowiki>ipa.tetrain.com</nowiki></code>'s install printed and unattended mode explicitly skipped: *"66 existing users or groups do not have a SID identifier assigned... installer will NOT run ipa-sidgen task."* Confirmed via LDAP: <code><nowiki>biswajit</nowiki></code> had no <code><nowiki>ipaNTSecurityIdentifier</nowiki></code> attribute at all (<code><nowiki>admin</nowiki></code> did — <code><nowiki>S-1-5-21-...-500</nowiki></code>). '''59 users total''' were affected — this would have broken login for the vast majority of real users the moment cutover happened, not just one account. Root cause of why it only breaks on the *new* server despite identical replicated LDAP data: <code><nowiki>ipa.tetrain.com</nowiki></code>'s install activated the AD-trust/SID plugin, and this IPA version (4.13) enforces PAC/SID generation during Kerberos ticket issuance more strictly than the old IPA 4.6 server does — the old server simply doesn't hit this code path.

'''Fixed''': <code><nowiki>ipa-adtrust-install</nowiki></code> wasn't even installed (separate package). Installed <code><nowiki>ipa-server-trust-ad</nowiki></code>, then ran <code><nowiki>ipa-adtrust-install -U --add-sids</nowiki></code> (client ran it directly, on <code><nowiki>ipa.tetrain.com</nowiki></code>) — completed the <code><nowiki>[23/24]: adding SIDs to existing users and groups</nowiki></code> step. '''Verified''': <code><nowiki>biswajit</nowiki></code> now has <code><nowiki>ipaNTSecurityIdentifier: S-1-5-21-...-1003</nowiki></code>, '''0 users remaining without a SID''', all services still healthy (plus two new ones now running: <code><nowiki>smb</nowiki></code>, <code><nowiki>winbind</nowiki></code>). Awaiting client's re-test of the actual web UI login to close this out completely.

'''Lesson for future replica builds''': never skip the <code><nowiki>ipa-sidgen</nowiki></code> unattended-mode warning as cosmetic — it silently breaks real-user authentication on the new server while looking completely fine in every health check that doesn't test a non-admin account specifically. This is exactly why testing with a real user, not just <code><nowiki>admin</nowiki></code>, mattered here.