Is that the client version as well?
<br>

<br>
Andy
<br>

<br>
On Tue, 14 Oct 2014, apeters1971 wrote:
<br>

<br>
&gt; It is xrootd-3.3.6-4.CERN ....
<br>
&gt;
<br>
&gt; Cheers Andreas.
<br>
&gt;
<br>
&gt;
<br>
&gt; On Tue, Oct 14, 2014 at 8:04 PM, Andrew Hanushevsky &lt;
<br>
&gt; <a href="/cgi-bin/wa?LOGON=A3%3Dind1410%26L%3DXROOTD-DEV%26E%3Dquoted-printable%26P%3D546396%26B%3D----%253D%253D_mimepart_543d73c12a52f_376f3fc94166129c991a4%26T%3Dtext%252Fhtml%3B%2520charset%3DUTF-8%26pending%3D" target="_parent" >[log in to unmask]</a>&gt; wrote:
<br>
&gt;
<br>
&gt;&gt; Hi Andreas,
<br>
&gt;&gt;
<br>
&gt;&gt; If you are using an old (really old) client you will get this problem as
<br>
&gt;&gt; it doesn&#39;t send its hostname. The sss preferentially checks for a hostname
<br>
&gt;&gt; match but if one does not get sent (as is the case in old clients) it
<br>
&gt;&gt; checks the ip address. So, we eed to reconcile which versions are being
<br>
&gt;&gt; used.
<br>
&gt;&gt;
<br>
&gt;&gt; Andy
<br>
&gt;&gt;
<br>
&gt;&gt; P.S. Does the client actually have a hostname?
<br>
&gt;&gt;
<br>
&gt;&gt; On Tue, 14 Oct 2014, apeters1971 wrote:
<br>
&gt;&gt;
<br>
&gt;&gt;&gt; We have the following problem that &#39;sss&#39; authentication behind a NAT
<br>
&gt;&gt; does not work.
<br>
&gt;&gt;&gt;
<br>
&gt;&gt;&gt; As expected the symptom is a name/ip mismatch:
<br>
&gt;&gt;&gt; ```
<br>
&gt;&gt;&gt; 141014 11:53:19 17643 root.4168:21@asa-uefke-grid-01 XrootdProtocol:
<br>
&gt;&gt; 0100 req=3000 dlen=151
<br>
&gt;&gt;&gt; sec_PM: Using sss protocol, args=&#39;0.13:/etc/sss.keytab&#39;
<br>
&gt;&gt;&gt; 141014 11:53:19 17643 XrootdXeq: User authentication failed; IP address
<br>
&gt;&gt; mismatch.
<br>
&gt;&gt;&gt; 141014 11:53:19 17643 root.4168:21@asa-uefke-grid-01 XrootdResponse:
<br>
&gt;&gt; 0100 sending err 3010: IP address mismatch.
<br>
&gt;&gt;&gt; ```
<br>
&gt;&gt;&gt; Was this case forseen in the &#39;sss&#39; authentication model?
<br>
&gt;&gt;&gt;
<br>
&gt;&gt;&gt;
<br>
&gt;&gt;&gt;
<br>
&gt;&gt;&gt; ---
<br>
&gt;&gt;&gt; Reply to this email directly or view it on GitHub:
<br>
&gt;&gt;&gt; https://github.com/xrootd/xrootd/issues/147
<br>
&gt;&gt;
<br>
&gt;&gt; ÿÿ
<br>
&gt;&gt; Reply to this email directly or view it on GitHub
<br>
&gt;&gt; &lt;https://github.com/xrootd/xrootd/issues/147#issuecomment-59089434&gt;.
<br>
&gt;&gt;
<br>
&gt;
<br>
&gt; ---
<br>
&gt; Reply to this email directly or view it on GitHub:
<br>
&gt; https://github.com/xrootd/xrootd/issues/147#issuecomment-59098018

<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">&mdash;<br>Reply to this email directly or <a href="https://github.com/xrootd/xrootd/issues/147#issuecomment-59098499">view it on GitHub</a>.<img alt="" height="1" src="https://github.com/notifications/beacon/4118670__eyJzY29wZSI6Ik5ld3NpZXM6QmVhY29uIiwiZXhwaXJlcyI6MTcyODkzMjY3MywiZGF0YSI6eyJpZCI6NDU3MjA4MTN9fQ==--e953e63fa0d70320c46f2010bc6a309b32a92d76.gif" width="1" /></p>
<!cript type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","description":"View this Issue on GitHub","action":{"@type":"ViewAction","url":"https://github.com/xrootd/xrootd/issues/147#issuecomment-59098499","name":"View Issue"}}</script><br>
<hr>
<p align="left">
Use REPLY-ALL to reply to list</p>
<p align="center">To unsubscribe from the XROOTD-DEV list, click the following link:<br>
<a href="https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1" target="_blank">https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1</a>
</p>