PowerShell / PowerShell/Win32-OpenSSH

User principal name lookup failed for user

Open
#1,934 6 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
8.3k
Forks
819
PR merge metrics
No merged PRs in 30d

Description

Troubleshooting steps
https://github.com/PowerShell/Win32-OpenSSH/wiki/Troubleshooting-Steps

Terminal issue? please go through wiki
https://github.com/PowerShell/Win32-OpenSSH/wiki/TTY-PTY-support-in-Windows-OpenSSH

Please answer the following

"OpenSSH for Windows" version
((Get-Item (Get-Command sshd).Source).VersionInfo.FileVersion)
8.1.0.1 and also tried on 8.9.1.0

Server OperatingSystem
((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows nt\CurrentVersion\" -Name ProductName).ProductName)
Windows 10 Enterprise for Virtual Desktops

(The server run on VMs with are AD joined )

Client OperatingSystem
Windows 10/11

What is failing
SSH is failing to resolve ntdev domain login. The user is an Admin on the VM they are attempting to connect to

26508 2022-04-18 23:03:01.524 debug3: checking match for 'Group administrators' user ntdev\\alias host 10.91.192.254 addr 10.91.192.254 laddr 10.249.236.212 lport 22
26508 2022-04-18 23:03:03.858 error: lookup_principal_name: User principal name lookup failed for user 'ntdev\\alias ' (explicit: 1355, implicit: 1355)
26508 2022-04-18 23:03:03.859 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'ntdev\\alias ' Status: 0xC0000062 SubStatus 0.
26508 2022-04-18 23:03:03.859 debug3: get_user_token - unable to generate token for user ntdev\\alias 
26508 2022-04-18 23:03:06.996 error: lookup_principal_name: User principal name lookup failed for user 'ntdev\\alias ' (explicit: 1355, implicit: 1355)
26508 2022-04-18 23:03:06.996 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'ntdev\\alias ' Status: 0xC0000062 SubStatus 0.
26508 2022-04-18 23:03:06.996 error: get_user_token - unable to generate token on 2nd attempt for user ntdev\\alias 
26508 2022-04-18 23:03:06.996 fatal: ga_init, unable to resolve user ntdev\\alias 
26508 2022-04-18 23:03:06.996 debug1: do_cleanup
26508 2022-04-18 23:03:06.996 debug1: Killing privsep child 22072
7612 2022-04-18 23:03:07.000 debug2: pselect_notify_done: reading

If the user connects via RDP to that VM and then connects via SSH it works. Im assuming the cached credentials are helping to resolve the upn in this scenario?

25420 2022-04-13 17:40:32.485 debug3: checking match for 'Group administrators' user ntdev\\alias host 10.137.119.64 addr 10.137.119.64 laddr 10.144.116.10 lport 22
25420 2022-04-13 17:40:32.844 debug3: lookup_principal_name: Successfully discovered explicit principal name: 'ntdev\\alias'=>'alias@ntdev.microsoft.com'
25420 2022-04-13 17:40:32.907 debug3: LsaLogonUser Succeeded (Impersonation: 0)
25420 2022-04-13 17:40:32.907 debug1: user ntdev\\alias matched group list administrators at line 85

I am not well versed in AAD so any help on knowing if this is on the SSH side of things or AAD side would be appreciated

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the lookup_principal_name and generate_s4u_user_token log paths, comparing the failing direct SSH case with the successful post-RDP case. No source file or test is named; done would require reproducing the UPN lookup failure and documenting or fixing the Windows/AAD authentication behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
authentication, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.