Weird issue when using SSSD w/ AD

Description of problem:

When using pam auth against SSSD for AD users I get a mixture of segfaults and errors however local ( pam_unix ) users work fine. If there's anything you can suggest to try or methods to get more information I will be more than happy to do as I'm still actively trying to resolve on my own.

Version of ocserv used:

Git master d0e8ff2f

Client used:

Anyconnect 5.1.2.42

Distributor of ocserv

Ubuntu 22.04.4 LTS

How reproducible:

I'm not sure how to reproduce this secondarily, however it can be arranged to be hands-on with this system. The system was joined to an AD domain using realmd/adcli and is using the following configuration:

# cat /etc/sssd/sssd.conf

[sssd]
domains = DOMAIN
config_file_version = 2
services = nss, pam

[domain/corp.rplocal.net]
default_shell = /bin/bash
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = DOMAIN
realmd_tags = manages-system joined-with-adcli
id_provider = ad
fallback_homedir = /home/%u@%d
ad_domain = domain
use_fully_qualified_names = False
ldap_id_mapping = True
access_provider = ad
# cat /etc/ocserv/ocserv.conf | egrep -v '(^$|^\s*#)'
auth = "pam"
tcp-port = 443
udp-port = 443
run-as-user = nobody
run-as-group = daemon
socket-file = /run/ocserv.socket
server-cert = /etc/ssl/certs/ssl-cert-snakeoil.pem
server-key = /etc/ssl/private/ssl-cert-snakeoil.key
ca-cert = /etc/ssl/certs/ssl-cert-snakeoil.pem
isolate-workers = false
banner = ""
max-clients = 128
max-same-clients = 2
stats-report-time = 5
server-stats-reset-time = 604800
keepalive = 10
dpd = 5
mobile-dpd = 10
switch-to-tcp-timeout = 25
try-mtu-discovery = true
cert-user-oid = 0.9.2342.19200300.100.1.1
compression = true
no-compress-limit = 256
auth-timeout = 60
idle-timeout = 1200
mobile-idle-timeout = 1800
min-reauth-time = 300
max-ban-score = 80
ban-reset-time = 300
cookie-timeout = 300
deny-roaming = false
rekey-time = 172800
rekey-method = ssl
use-occtl = true
pid-file = /run/ocserv.pid
device = vpns
predictable-ips = true
default-domain = DOMAIN
ipv4-network = IPRANGE
tunnel-all-dns = true
dns = IP
dns = IP
split-dns = DOMAIN
ping-leases = true
route = default
user-profile = /etc/ocserv/profile.xml
root@IN1-CORP-VPN:~/ocserv# cat /etc/pam.d/ocserv | egrep -v '(^$|^\s*#)'
auth    [success=1 default=ignore]      pam_sss.so
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so
auth    optional                        pam_cap.so
account       required     pam_nologin.so
account sufficient                       pam_permit.so
@include common-session
session    required     pam_limits.so
@include common-password
# id user
uid=811001104(user) gid=811000513(domain users) groups=811000513(domain users),811001113(some_group),811001125(some_group),811000519(some_group),811001106(some_group),811000512(some_group),811000572(denied rodc password replication group)

Actual results:

Last attempt

ocserv[105448]: sec-mod: received request from pid 105449 and uid 65534
ocserv[105449]: worker[DOMAIN\user]: 123.123.123.123 sending message 'sm: auth cont' to secmod
ocserv[105448]: sec-mod: cmd [size=63] sm: auth cont
ocserv[105448]: sec-mod: auth cont for user 'DOMAIN\user' (session: vdGWO7)
ocserv[105448]: pam_sss(ocserv:auth): authentication success; logname= uid=0 euid=0 tty= ruser= rhost=123.123.123.123 user=DOMAIN\user
malloc(): smallbin double linked list corrupted
ocserv[105447]: main: main-sec-mod-cmd.c:107: command socket for sec-mod closed
ocserv[105447]: main: main.c:1242: error in command from sec-mod
ocserv[105447]: main: termination request received; waiting for sessions to terminate

Segfault from a different attempt

45392-Aug 31 22:09:31 HOSTNAME ocserv[104104]: sec-mod: using 'pam' authentication to authenticate user (session: mhQkN4)
45395:Aug 31 22:09:33 HOSTNAME kernel: ocserv-sm[104104]: segfault at 180000010 ip 00007fe9535acac1 sp 000055948d66c1a0 error 6 in libc.so.6[7fe953531000+195000]
45396-Aug 31 22:09:33 HOSTNAME kernel: Code: 00 48 39 ce 0f 84 07 06 00 00 4c 8b 61 18 4a 83 4c 29 08 01 4c 39 cb 74 05 48 83 49 08 04 4c 8b 34 24 4c 89 62 08 41 83 c2 01 <49> 89 74 24 10 4c 89 71 18 4c 8d 71 10 4c 89 74 24 08 49 c1 ee 0c
45397-Aug 31 22:09:33 HOSTNAME ocserv[104106]: worker[domain\user]: 208.253.89.50 worker-auth.c:788: error receiving auth reply message
45398-Aug 31 22:09:33 HOSTNAME ocserv[104103]: main: main-sec-mod-cmd.c:107: command socket for sec-mod closed

Expected results:

ocserv-sm returning a valid result of success or failure

Edited by James Vess