Skip to content

Regression in IPA nightly tests: test_idp.py fails #8616

Closed
#8617
Closed
Regression in IPA nightly tests: test_idp.py fails#8616
#8617

Description

@flo-renaud
flo-renaud
opened on Apr 20, 2026

The FreeIPA nightly test test_integration/test_idp.py::TestIDPKeycloak::test_auth_keycloak_idp detected a regression with the SSSD package installed from the copr repo @sssd/nightly.

Test scenario:
Configure a keycloak server and create a user
/opt/keycloak/bin/kcadm.sh create users -r master -s username=testuser1 -s enabled=true -s [email protected]
/opt/keycloak/bin/kcadm.sh set-password -r master --username testuser1 --new-password Secret.123
Add an external IDP server to IPA with ipa idp-add keycloakidp --provider keycloak --client-id=ipa_oidc_client --org master --baseurl=keycloakserver.ufreeipa.test:8443
Add a user ipa user-add keycloakuser --first test --last user --user-auth-type=idp [email protected] --idp=keycloakidp
Try to obtain a kerberos ticket for this user:
kinit -n -v /tmp/armor
kinit -T /tmp/armor keycloakuser

The test fails to obtain the kerberos ticket

Logs available in https://$ARTIFACT_SERVER/idm-ci/freeipa_upstream_nightly/Nightly-latest-sssd/master/2026-04-18_15-55/sssd/test_external_idp/2/

Apr 20 08:36:00 master.ufreeipa.test systemd[1]: Started ipa-otpd@0-19-33408_33409-0.service - ipa-otpd service (PID 33408/UID 0).
Apr 20 08:36:00 master.ufreeipa.test ipa-otpd[38013]: LDAP: ldapi://%2Frun%2Fslapd-UFREEIPA-TEST.socket
Apr 20 08:36:00 master.ufreeipa.test ipa-otpd[38013]: [email protected]: request received
Apr 20 08:36:00 master.ufreeipa.test ipa-otpd[38013]: [email protected]: user query start
Apr 20 08:36:00 master.ufreeipa.test ipa-otpd[38013]: [email protected]: user query end: uid=keycloakuser,cn=users,cn=accounts,dc=ufreeipa,dc=test
Apr 20 08:36:00 master.ufreeipa.test ipa-otpd[38013]: [email protected]: idp query start: cn=keycloakidp,cn=idp,dc=ufreeipa,dc=test
Apr 20 08:36:00 master.ufreeipa.test ipa-otpd[38013]: [email protected]: idp query end: keycloakidp
Apr 20 08:36:00 master.ufreeipa.test ipa-otpd[38013]: [email protected]: oauth2 start: Get device code
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: oidc_child started, running command [get-device-code][1]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: Running with effective IDs: [0][0].
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: Running with real IDs [0][0].
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: Setting POST data.
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * Host replica1.ufreeipa.test:8443 was resolved.
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * IPv6: (none)
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * IPv4: 10.0.191.160
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *   Trying 10.0.191.160:8443...
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * ALPN: curl offers h2,http/1.1
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (OUT), TLS handshake, Client hello (1):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  CAfile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  CApath: none
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (IN), TLS handshake, Server hello (2):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (IN), TLS handshake, Certificate (11):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (IN), TLS handshake, CERT verify (15):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (IN), TLS handshake, Finished (20):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (OUT), TLS handshake, Finished (20):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / x25519 / RSASSA-PSS
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * ALPN: server accepted h2
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * Server certificate:
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  subject: O=UFREEIPA.TEST; CN=replica1.ufreeipa.test
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  start date: Apr 20 08:32:58 2026 GMT
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  expire date: Apr 20 08:32:58 2028 GMT
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  subjectAltName: host "replica1.ufreeipa.test" matched cert's "replica1.ufreeipa.test"
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  issuer: O=UFREEIPA.TEST; CN=Certificate Authority
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  SSL certificate verify ok.
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *   Certificate level 1: Public key type RSA (3072/128 Bits/secBits), signed using sha256WithRSAEncryption
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * Connected to replica1.ufreeipa.test (10.0.191.160) port 8443
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * using HTTP/2
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] OPENED stream for https://replica1.ufreeipa.test:8443/realms/master/protocol/openid-connect/auth/device
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [:method: POST]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [:scheme: https]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [:authority: replica1.ufreeipa.test:8443]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [:path: /realms/master/protocol/openid-connect/auth/device]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [user-agent: SSSD oidc_child/0.0]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [accept: application/json]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [content-length: 46]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [content-type: application/x-www-form-urlencoded]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: > POST /realms/master/protocol/openid-connect/auth/device HTTP/2
                                                        Host: replica1.ufreeipa.test:8443
                                                        User-Agent: SSSD oidc_child/0.0
                                                        Accept: application/json
                                                        Content-Length: 46
                                                        Content-Type: application/x-www-form-urlencoded
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * upload completely sent off: 46 bytes
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: < HTTP/2 200
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: < cache-control: no-store, must-revalidate, max-age=0
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: < content-length: 300
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: < content-type: application/json
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: < referrer-policy: no-referrer
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: < strict-transport-security: max-age=31536000; includeSubDomains
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: < x-content-type-options: nosniff
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: < x-frame-options: SAMEORIGIN
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: <
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * Connection #0 to host replica1.ufreeipa.test left intact
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: Result does not contain the 'message' string.
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: user_code: [EXTN-OZJK].
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: verification_uri: [https://replica1.ufreeipa.test:8443/realms/master/device].
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: verification_uri_complete: [https://replica1.ufreeipa.test:8443/realms/master/device?user_code=EXTN-OZJK].
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: message: [(null)].
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: device_code: [-JPTK3Q9Y9DXl0oaVymar5zh0ca20c14IqYXLoo262A].
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: expires_in: [600].
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: interval: [5].
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: Setting POST data.
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * Host replica1.ufreeipa.test:8443 was resolved.
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * IPv6: (none)
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * IPv4: 10.0.191.160
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *   Trying 10.0.191.160:8443...
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * ALPN: curl offers h2,http/1.1
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (OUT), TLS handshake, Client hello (1):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  CAfile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  CApath: none
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (IN), TLS handshake, Server hello (2):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (IN), TLS handshake, Certificate (11):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (IN), TLS handshake, CERT verify (15):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (IN), TLS handshake, Finished (20):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (OUT), TLS handshake, Finished (20):
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / x25519 / RSASSA-PSS
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * ALPN: server accepted h2
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * Server certificate:
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  subject: O=UFREEIPA.TEST; CN=replica1.ufreeipa.test
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  start date: Apr 20 08:32:58 2026 GMT
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  expire date: Apr 20 08:32:58 2028 GMT
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  subjectAltName: host "replica1.ufreeipa.test" matched cert's "replica1.ufreeipa.test"
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  issuer: O=UFREEIPA.TEST; CN=Certificate Authority
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *  SSL certificate verify ok.
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: *   Certificate level 1: Public key type RSA (3072/128 Bits/secBits), signed using sha256WithRSAEncryption
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * Connected to replica1.ufreeipa.test (10.0.191.160) port 8443
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * using HTTP/2
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] OPENED stream for https://replica1.ufreeipa.test:8443/realms/master/protocol/openid-connect/token
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [:method: POST]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [:scheme: https]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [:authority: replica1.ufreeipa.test:8443]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [:path: /realms/master/protocol/openid-connect/token]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [user-agent: SSSD oidc_child/0.0]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [accept: application/json]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [content-length: 137]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * [HTTP/2] [1] [content-type: application/x-www-form-urlencoded]
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: > POST /realms/master/protocol/openid-connect/token HTTP/2
                                                        Host: replica1.ufreeipa.test:8443
                                                        User-Agent: SSSD oidc_child/0.0
                                                        Accept: application/json
                                                        Content-Length: 137
                                                        Content-Type: application/x-www-form-urlencoded
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * upload completely sent off: 137 bytes
Apr 20 08:36:00 master.ufreeipa.test oidc_child[38014]: libcurl: * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
Apr 20 08:36:01 master.ufreeipa.test oidc_child[38014]: libcurl: < HTTP/2 400
Apr 20 08:36:01 master.ufreeipa.test oidc_child[38014]: libcurl: < cache-control: no-store
Apr 20 08:36:01 master.ufreeipa.test oidc_child[38014]: libcurl: < pragma: no-cache
Apr 20 08:36:01 master.ufreeipa.test oidc_child[38014]: libcurl: < content-length: 98
Apr 20 08:36:01 master.ufreeipa.test oidc_child[38014]: libcurl: < content-type: application/json
Apr 20 08:36:01 master.ufreeipa.test oidc_child[38014]: libcurl: < referrer-policy: no-referrer
Apr 20 08:36:01 master.ufreeipa.test oidc_child[38014]: libcurl: < strict-transport-security: max-age=31536000; includeSubDomains
Apr 20 08:36:01 master.ufreeipa.test oidc_child[38014]: libcurl: < x-content-type-options: nosniff
Apr 20 08:36:01 master.ufreeipa.test oidc_child[38014]: libcurl: < x-frame-options: SAMEORIGIN
Apr 20 08:36:01 master.ufreeipa.test oidc_child[38014]: libcurl: <
Apr 20 08:36:01 master.ufreeipa.test oidc_child[38014]: libcurl: * Connection #0 to host replica1.ufreeipa.test left intact
Apr 20 08:36:01 master.ufreeipa.test oidc_child[38014]: oidc_child finished successfully!
Apr 20 08:36:01 master.ufreeipa.test ipa-otpd[38013]: [email protected]: Received: [{"device_code":"-JPTK3Q9Y9DXl0oaVymar5zh0ca20c14IqYXLoo262A","expires_in":600,"interval":5}
Apr 20 08:36:01 master.ufreeipa.test ipa-otpd[38013]: oauth2 {"verification_uri": "https://replica1.ufreeipa.test:8443/realms/master/device", "user_code": "EXTN-OZJK", "verification_uri_complete": "https://replica1.ufreeipa.test:8443/realms/master/device?user_code=EXTN-OZJK"}
Apr 20 08:36:01 master.ufreeipa.test ipa-otpd[38013]: ]
Apr 20 08:36:01 master.ufreeipa.test ipa-otpd[38013]:   oauth2.c:089: Child finished with status [0].
Apr 20 08:36:01 master.ufreeipa.test ipa-otpd[38013]: [email protected]: sent: 0 data: 337
Apr 20 08:36:01 master.ufreeipa.test ipa-otpd[38013]: [email protected]: ..sent: 337 data: 337
Apr 20 08:36:01 master.ufreeipa.test ipa-otpd[38013]: [email protected]: response sent: Access-Challenge
Apr 20 08:36:01 master.ufreeipa.test ipa-otpd[38013]: Socket closed, shutting down...
Apr 20 08:36:01 master.ufreeipa.test systemd[1]: ipa-otpd@0-19-33408_33409-0.service: Deactivated successfully.
Apr 20 08:36:01 master.ufreeipa.test audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ipa-otpd@0-19-33408_33409-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Apr 20 08:36:01 master.ufreeipa.test NetworkManager[751]: <warn>  [1776674161.6244] ipv6ll[29a24b79de273979,ifindex=2]: changed: no IPv6 link local address to retry after Duplicate Address Detection failures (back off)
Apr 20 08:36:01 master.ufreeipa.test NetworkManager[751]: <warn>  [1776674161.6249] platform-linux: do-add-ip6-address[2: 2620:52:0:bf:f816:3eff:fe51:2324]: failure 13 (Permission denied - ipv6: IPv6 is disabled on this device)
Apr 20 08:36:01 master.ufreeipa.test NetworkManager[751]: <warn>  [1776674161.6250] l3cfg[736ce60ad4bf3278,ifindex=2]: unable to configure IPv6 route: type unicast fe80::4e16:fc01:5983:88aa/128 dev 2 metric 100 mss 0 rt-src ndisc
Apr 20 08:36:11 master.ufreeipa.test NetworkManager[751]: <warn>  [1776674171.6266] platform-linux: do-add-ip6-address[2: fe80::f816:3eff:fe51:2324]: failure 13 (Permission denied - ipv6: IPv6 is disabled on this device)
Apr 20 08:36:11 master.ufreeipa.test NetworkManager[751]: <warn>  [1776674171.6267] platform-linux: do-add-ip6-address[2: 2620:52:0:bf:f816:3eff:fe51:2324]: failure 13 (Permission denied - ipv6: IPv6 is disabled on this device)
Apr 20 08:36:11 master.ufreeipa.test NetworkManager[751]: <warn>  [1776674171.6267] l3cfg[736ce60ad4bf3278,ifindex=2]: unable to configure IPv6 route: type unicast fe80::/64 dev 2 metric 1024 mss 0 rt-src ipv6ll
Apr 20 08:36:13 master.ufreeipa.test NetworkManager[751]: <warn>  [1776674173.6285] ipv6ll[29a24b79de273979,ifindex=2]: changed: no IPv6 link local address to retry after Duplicate Address Detection failures (back off)
Apr 20 08:36:13 master.ufreeipa.test NetworkManager[751]: <warn>  [1776674173.6287] platform-linux: do-add-ip6-address[2: 2620:52:0:bf:f816:3eff:fe51:2324]: failure 13 (Permission denied - ipv6: IPv6 is disabled on this device)
Apr 20 08:36:13 master.ufreeipa.test NetworkManager[751]: <warn>  [1776674173.6287] l3cfg[736ce60ad4bf3278,ifindex=2]: unable to configure IPv6 route: type unicast fe80::4e16:fc01:5983:88aa/128 dev 2 metric 100 mss 0 rt-src ndisc
Apr 20 08:36:22 master.ufreeipa.test systemd[1]: Started ipa-otpd@1-20-33409_33410-0.service - ipa-otpd service (PID 33409/UID 0).
Apr 20 08:36:22 master.ufreeipa.test audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ipa-otpd@1-20-33409_33410-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]: LDAP: ldapi://%2Frun%2Fslapd-UFREEIPA-TEST.socket
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]: [email protected]: request received
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]: [email protected]: user query start
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]: [email protected]: user query end: uid=keycloakuser,cn=users,cn=accounts,dc=ufreeipa,dc=test
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]: [email protected]: idp query start: cn=keycloakidp,cn=idp,dc=ufreeipa,dc=test
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]: [email protected]: idp query end: keycloakidp
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]: [email protected]: oauth2 start: Get access token
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: oidc_child started, running command [get-access-token][2]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: Running with effective IDs: [0][0].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: Running with real IDs [0][0].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: JSON device code: [{"device_code":"-JPTK3Q9Y9DXl0oaVymar5zh0ca20c14IqYXLoo262A","expires_in":600,"interval":5}].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: Result does not contain the 'user_code' string.
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: Result does not contain the 'verification_uri' string.
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: Result does not contain the 'verification_url' string.
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: Result does not contain the 'verification_uri_complete' string.
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: Result does not contain the 'message' string.
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: device_code: [-JPTK3Q9Y9DXl0oaVymar5zh0ca20c14IqYXLoo262A].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: expires_in: [600].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: interval: [5].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: Setting POST data.
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * Host replica1.ufreeipa.test:8443 was resolved.
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * IPv6: (none)
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * IPv4: 10.0.191.160
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *   Trying 10.0.191.160:8443...
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * ALPN: curl offers h2,http/1.1
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (OUT), TLS handshake, Client hello (1):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  CAfile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  CApath: none
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (IN), TLS handshake, Server hello (2):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (IN), TLS handshake, Certificate (11):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (IN), TLS handshake, CERT verify (15):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (IN), TLS handshake, Finished (20):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (OUT), TLS handshake, Finished (20):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / x25519 / RSASSA-PSS
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * ALPN: server accepted h2
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * Server certificate:
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  subject: O=UFREEIPA.TEST; CN=replica1.ufreeipa.test
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  start date: Apr 20 08:32:58 2026 GMT
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  expire date: Apr 20 08:32:58 2028 GMT
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  subjectAltName: host "replica1.ufreeipa.test" matched cert's "replica1.ufreeipa.test"
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  issuer: O=UFREEIPA.TEST; CN=Certificate Authority
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  SSL certificate verify ok.
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *   Certificate level 1: Public key type RSA (3072/128 Bits/secBits), signed using sha256WithRSAEncryption
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * Connected to replica1.ufreeipa.test (10.0.191.160) port 8443
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * using HTTP/2
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] OPENED stream for https://replica1.ufreeipa.test:8443/realms/master/protocol/openid-connect/token
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [:method: POST]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [:scheme: https]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [:authority: replica1.ufreeipa.test:8443]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [:path: /realms/master/protocol/openid-connect/token]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [user-agent: SSSD oidc_child/0.0]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [accept: application/json]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [content-length: 137]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [content-type: application/x-www-form-urlencoded]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: > POST /realms/master/protocol/openid-connect/token HTTP/2
                                                        Host: replica1.ufreeipa.test:8443
                                                        User-Agent: SSSD oidc_child/0.0
                                                        Accept: application/json
                                                        Content-Length: 137
                                                        Content-Type: application/x-www-form-urlencoded
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * upload completely sent off: 137 bytes
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < HTTP/2 200
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < cache-control: no-store
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < pragma: no-cache
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < content-length: 3324
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < content-type: application/json
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < referrer-policy: no-referrer
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < strict-transport-security: max-age=31536000; includeSubDomains
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < x-content-type-options: nosniff
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < x-frame-options: SAMEORIGIN
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: <
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * Connection #0 to host replica1.ufreeipa.test left intact
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * Host replica1.ufreeipa.test:8443 was resolved.
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * IPv6: (none)
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * IPv4: 10.0.191.160
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *   Trying 10.0.191.160:8443...
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * ALPN: curl offers h2,http/1.1
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (OUT), TLS handshake, Client hello (1):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  CAfile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  CApath: none
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (IN), TLS handshake, Server hello (2):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (IN), TLS handshake, Certificate (11):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (IN), TLS handshake, CERT verify (15):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (IN), TLS handshake, Finished (20):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (OUT), TLS handshake, Finished (20):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / x25519 / RSASSA-PSS
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * ALPN: server accepted h2
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * Server certificate:
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  subject: O=UFREEIPA.TEST; CN=replica1.ufreeipa.test
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  start date: Apr 20 08:32:58 2026 GMT
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  expire date: Apr 20 08:32:58 2028 GMT
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  subjectAltName: host "replica1.ufreeipa.test" matched cert's "replica1.ufreeipa.test"
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  issuer: O=UFREEIPA.TEST; CN=Certificate Authority
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *  SSL certificate verify ok.
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: *   Certificate level 1: Public key type RSA (3072/128 Bits/secBits), signed using sha256WithRSAEncryption
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * Connected to replica1.ufreeipa.test (10.0.191.160) port 8443
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * using HTTP/2
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * Server auth using Bearer with user ''
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] OPENED stream for https://replica1.ufreeipa.test:8443/realms/master/protocol/openid-connect/userinfo
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [:method: GET]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [:scheme: https]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [:authority: replica1.ufreeipa.test:8443]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [:path: /realms/master/protocol/openid-connect/userinfo]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJzWXYxX0J4S2k1ZjBtcjV4Qk9qbFZ3TlRSVjl0XzFnOFlONjhQQ1lmaEdvIn0.eyJleHAiOjE3NzY2NzQyNDIsImlhdCI6MTc3NjY3NDE4MiwiYXV0aF90aW1lIjoxNzc2Njc0MTgwLCJqdGkiOiJvbnJ0ZGc6MDUxZGJhZTctMzk5OC00MmExLWFjNzYtOTZlN2E5YWE2NWJhIiwiaXNzIjoiaHR0cHM6Ly9yZXBsaWNhMS51ZnJlZWlwYS50ZXN0Ojg0NDMvcmVhbG1zL21hc3RlciIsImF1ZCI6ImFjY291bnQiLCJzdWIiOiIxZmMzNzliYy1kY2IxLTQ5ZDAtYTFjYi0wMDlmNGYwYWE2ZDQiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJpcGFfb2lkY19jbGllbnQiLCJzaWQiOiJmZjE1MWI1Ny04YzFhLWEyOGQtM2JlZi00ZDgwNjg4OTYyNzIiLCJhY3IiOiIxIiwiYWxsb3dlZC1vcmlnaW5zIjpbImh0dHBzOi8vaXBhLWNhLnVmcmVlaXBhLnRlc3QiXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtbWFzdGVyIiwib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsInByZWZlcnJlZF91c2VybmFtZSI6InRlc3R1c2VyMSIsImVtYWlsIjoidGVzdHVzZXIxQGlwYS50ZXN0In0.PmElsKTlJxDVcF8AJx3Q5JoajDdNMY1mQUb_HmeCz1lRqpihP4Mtgy31OA2uy_klLtNKBMdvGVPC_ylR4MXjfykBHdhTNyyPTbQt-C1LOkBWdNQLG7lmSF58UoK84wyGKNZ6DppDRs0fXqG9fmiYYpyxD1yE346chrAAcg63d2pkll7JBcZaG5SO0FbeI0rB23djC0v2rmcSG7Vlw4pBTv-jRrBD0wIMqFeYiCryXmgAYZ7TvC9eoWezrgxerqbINEdZKvW1fj5Ooa3MD4bmXdWv5tkgLSUBwnwrw3IX2I6bHsO5V1GS1ARl8sv1YX4NySe2HI9kAwWSTLj2bq3k_A]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [user-agent: SSSD oidc_child/0.0]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * [HTTP/2] [1] [accept: application/json]
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: > GET /realms/master/protocol/openid-connect/userinfo HTTP/2
                                                        Host: replica1.ufreeipa.test:8443
                                                        Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJzWXYxX0J4S2k1ZjBtcjV4Qk9qbFZ3TlRSVjl0XzFnOFlONjhQQ1lmaEdvIn0.eyJleHAiOjE3NzY2NzQyNDIsImlhdCI6MTc3NjY3NDE4MiwiYXV0aF90aW1lIjoxNzc2Njc0MTgwLCJqdGkiOiJvbnJ0ZGc6MDUxZGJhZTctMzk5OC00MmExLWFjNzYtOTZlN2E5YWE2NWJhIiwiaXNzIjoiaHR0cHM6Ly9yZXBsaWNhMS51ZnJlZWlwYS50ZXN0Ojg0NDMvcmVhbG1zL21hc3RlciIsImF1ZCI6ImFjY291bnQiLCJzdWIiOiIxZmMzNzliYy1kY2IxLTQ5ZDAtYTFjYi0wMDlmNGYwYWE2ZDQiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJpcGFfb2lkY19jbGllbnQiLCJzaWQiOiJmZjE1MWI1Ny04YzFhLWEyOGQtM2JlZi00ZDgwNjg4OTYyNzIiLCJhY3IiOiIxIiwiYWxsb3dlZC1vcmlnaW5zIjpbImh0dHBzOi8vaXBhLWNhLnVmcmVlaXBhLnRlc3QiXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtbWFzdGVyIiwib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsInByZWZlcnJlZF91c2VybmFtZSI6InRlc3R1c2VyMSIsImVtYWlsIjoidGVzdHVzZXIxQGlwYS50ZXN0In0.PmElsKTlJxDVcF8AJx3Q5JoajDdNMY1mQUb_HmeCz1lRqpihP4Mtgy31OA2uy_klLtNKBMdvGVPC_ylR4MXjfykBHdhTNyyPTbQt-C1LOkBWdNQLG7lmSF58UoK84wyGKNZ6DppDRs0fXqG9fmiYYpyxD1yE346chrAAcg63d2pkll7JBcZaG5SO0FbeI0rB23djC0v2rmcSG7Vlw4pBTv-jRrBD0wIMqFeYiCryXmgAYZ7TvC9eoWezrgxerqbINEdZKvW1fj5Ooa3MD4bmXdWv5tkgLSUBwnwrw3IX2I6bHsO5V1GS1ARl8sv1YX4NySe2HI9kAwWSTLj2bq3k_A
                                                        User-Agent: SSSD oidc_child/0.0
                                                        Accept: application/json
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * Request completely sent off
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < HTTP/2 200
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < content-length: 131
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < cache-control: no-cache
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < content-type: application/json
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < referrer-policy: no-referrer
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < strict-transport-security: max-age=31536000; includeSubDomains
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < x-content-type-options: nosniff
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: < x-frame-options: SAMEORIGIN
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: <
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: libcurl: * Connection #0 to host replica1.ufreeipa.test left intact
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: User Principal: [(null)].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: User oid: [(null)].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: User sub: [1fc379bc-dcb1-49d0-a1cb-009f4f0aa6d4].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: Issued at: [1776674182].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: Expires at: [1776674242].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: User Principal: [(null)].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: User oid: [(null)].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: User sub: [1fc379bc-dcb1-49d0-a1cb-009f4f0aa6d4].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: Issued at: [1776674182].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: Expires at: [1776674242].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: User Principal: [(null)].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: User oid: [(null)].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: User sub: [1fc379bc-dcb1-49d0-a1cb-009f4f0aa6d4].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: Issued at: [1776674182].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: Expires at: [1776675982].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: User identifier: [[email protected]].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: User identifier: [[email protected]].
Apr 20 08:36:22 master.ufreeipa.test oidc_child[38020]: oidc_child finished successfully!
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]: [email protected]: Received: [{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJzWXYxX0J4S2k1ZjBtcjV4Qk9qbFZ3TlRSVjl0XzFnOFlONjhQQ1lmaEdvIn0.eyJleHAiOjE3NzY2NzQyNDIsImlhdCI6MTc3NjY3NDE4MiwiYXV0aF90aW1lIjoxNzc2Njc0MTgwLCJqdGkiOiJvbnJ0ZGc6MDUxZGJhZTctMzk5OC00MmExLWFjNzYtOTZlN2E5YWE2NWJhIiwiaXNzIjoiaHR0cHM6Ly9yZXBsaWNhMS51ZnJlZWlwYS50ZXN0Ojg0NDMvcmVhbG1zL21hc3RlciIsImF1ZCI6ImFjY291bnQiLCJzdWIiOiIxZmMzNzliYy1kY2IxLTQ5ZDAtYTFjYi0wMDlmNGYwYWE2ZDQiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJpcGFfb2lkY19jbGllbnQiLCJzaWQiOiJmZjE1MWI1Ny04YzFhLWEyOGQtM2JlZi00ZDgwNjg4OTYyNzIiLCJhY3IiOiIxIiwiYWxsb3dlZC1vcmlnaW5zIjpbImh0dHBzOi8vaXBhLWNhLnVmcmVlaXBhLnRlc3QiXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtbWFzdGVyIiwib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsInByZWZlcnJlZF91c2VybmFtZSI6InRlc3R1c2VyMSIsImVtYWlsIjoidGVzdHVzZXIxQGlwYS50ZXN0In0.PmElsKTlJxDVcF8AJx3Q5JoajDdNMY1mQUb_HmeCz1lRqpihP4Mtgy31OA2uy_klLtNKBMdvGVPC_ylR4MXjfykBHdhTNyyPTbQt-C1LOkBWdNQLG7lmSF58UoK84wyGKNZ6DppDRs0fXqG9fmiYYpyxD1yE346chrAAcg63d2pkll7JBcZaG5SO0FbeI0rB23djC0v2rmcSG7Vlw4pBTv-jRrBD0wIMqFeYiCryXmgAYZ7TvC9eoWezrgxerqbINEdZKvW1fj5Ooa3MD4bmXdWv5tkgLSUBwnwrw3IX2I6bHsO5V1GS1ARl8sv1YX4NySe2HI9kAwWSTLj2bq3k_A","id_token":"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJzWXYxX0J4S2k1ZjBtcjV4Qk9qbFZ3TlRSVjl0XzFnOFlONjhQQ1lmaEdvIn0.eyJleHAiOjE3NzY2NzQyNDIsImlhdCI6MTc3NjY3NDE4MiwiYXV0aF90aW1lIjoxNzc2Njc0MTgwLCJqdGkiOiJhOTA5MjAwMi00YTNkLTk3MmItMzlmNS00ZTAwN2Y2ZjM0ZjkiLCJpc3MiOiJodHRwczovL3JlcGxpY2ExLnVmcmVlaXBhLnRlc3Q6ODQ0My9yZWFsbXMvbWFzdGVyIiwiYXVkIjoiaXBhX29pZGNfY2xpZW50Iiwic3ViIjoiMWZjMzc5YmMtZGNiMS00OWQwLWExY2ItMDA5ZjRmMGFhNmQ0IiwidHlwIjoiSUQiLCJhenAiOiJpcGFfb2lkY19jbGllbnQiLCJzaWQiOiJmZjE1MWI1Ny04YzFhLWEyOGQtM2JlZi00ZDgwNjg4OTYyNzIiLCJhdF9oYXNoIjoiQ3NDWlJFRFpKWGtKRWoxUE13b3dWdyIsImFjciI6IjEiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsInByZWZlcnJlZF91c2VybmFtZSI6InRlc3R1c2VyMSIsImVtYWlsIjoidGVzdHVzZXIxQGlwYS50ZXN0In0.P4bsUh6DA2hA35_R-StYiloUDJ4jxIG2uECk2ccbW2FcBCRA73pMneQEGM3oKnBLm9IldI-ki72RbkAFzXSxNkdCiSsf39xhl9lPPLNx6dr3gaRKwQyDE5iAL700Yj1yw77eYTfbVH1jT5XcrJnUt2BJBicVA5GQNpxUie4v9PFfN2q8mFa7ccCmtfj7_-dkqWENrk_EZGY3M99kU3kITKQolk_ljhb_L-E7VGQUo804ljLRTBaKR1xiHKLUgDNzdmo7hDSqjjGkSMUrTeAgVVMXeCoZgW-wdfB7n-MC2gph1ojjLaKnKVxfHXlC3tbh-6rZPxc7SMSh1JFb2cSICw","refresh_token":"eyJhbGciOiJIUzUxMiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIwYmU2OGZkNi1jNTU2LTQ5ODItODE0YS0yNzgxY2JiMTk1YWYifQ.eyJleHAiOjE3NzY2NzU5ODIsImlhdCI6MTc3NjY3NDE4MiwianRpIjoiMDQ3ODAyMzctM2I5MC00MTZmLWNmMzEtMTFlMjY3NDZkNDY2IiwiaXNzIjoiaHR0cHM6Ly9yZXBsaWNhMS51ZnJlZWlwYS50ZXN0Ojg0NDMvcmVhbG1zL21hc3RlciIsImF1ZCI6Imh0dHBzOi8vcmVwbGljYTEudWZyZWVpcGEudGVzdDo4NDQzL3JlYWxtcy9tYXN0ZXIiLCJzdWIiOiIxZmMzNzliYy1kY2IxLTQ5ZDAtYTFjYi0wMDlmNGYwYWE2ZDQiLCJ0eXAiOiJSZWZyZXNoIiwiYXpwIjoiaXBhX29pZGNfY2xpZW50Iiwic2lkIjoiZmYxNTFiNTctOGMxYS1hMjhkLTNiZWYtNGQ4MDY4ODk2MjcyIiwic2NvcGUiOiJvcGVuaWQgd2ViLW9yaWdpbnMgcm9sZXMgYWNyIHByb2ZpbGUgZW1haWwgYmFzaWMifQ.9CFTByvojZqEHd7s7kZz9gVypNTf_nU6XKAlZMhq1g9X_NBp0BAYvUwdz5BiHEjC0SzJ4VCQ5ybYCdMvHmc8GQ","issued_at":1776674182,"expires_at":1776674242}
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]: [email protected]]
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]: [email protected]: Failed to check access token reply.
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]: [email protected]: sent: 0 data: 20
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]: [email protected]: ..sent: 20 data: 20
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]: [email protected]: response sent: Access-Reject
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]:   oauth2.c:089: Child finished with status [0].
Apr 20 08:36:22 master.ufreeipa.test ipa-otpd[38019]: Socket closed, shutting down...
Apr 20 08:36:22 master.ufreeipa.test systemd[1]: ipa-otpd@1-20-33409_33410-0.service: Deactivated successfully.

The test was green last week with sssd-client-2.13.0-0.260410.155221.git58cc4d226.fc43.x86_64
Fails this week with sssd-client-2.13.0-0.260415.103059.git80e648257.fc43.x86_64

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions