Problem:
Keycloak sso login on Portal not working
HTTP error 401
Server error message: Authentication failed. Please log in again.
Investigation:
/var/log/syslog
2026-07-13T15:09:13.100510+02:00 ucs01 sssd[608826]: Child [646413] ('schule.schein.ig':'%BE_schule.schein.ig') was terminated by own WATCHDOG. Consult corresponding logs
to figure out the reason.
2026-07-13T15:09:13.101174+02:00 ucs01 sssd[608826]: Exiting the SSSD. Could not restart critical service [nss].
2026-07-13T15:09:13.175656+02:00 ucs01 sssd_be[646884]: Starting up
2026-07-13T15:09:13.178655+02:00 ucs01 sssd_be[646884]: Shutting down (status = 0)
2026-07-13T15:09:13.183015+02:00 ucs01 sssd_be[608828]: Shutting down (status = 0)
2026-07-13T15:09:13.190826+02:00 ucs01 systemd[1]: sssd.service: Main process exited, code=exited, status=1/FAILURE
2026-07-13T15:09:13.190961+02:00 ucs01 systemd[1]: sssd.service: Failed with result 'exit-code'.
2026-07-13T15:09:13.191150+02:00 ucs01 systemd[1]: sssd.service: Consumed 4min 15.185s CPU time.
2026-07-13T15:09:13.191622+02:00 ucs01 systemd[1]: sssd-autofs.socket: Deactivated successfully.
2026-07-13T15:09:13.191882+02:00 ucs01 systemd[1]: Closed sssd-autofs.socket - SSSD AutoFS Service responder socket.
2026-07-13T15:09:13.192084+02:00 ucs01 systemd[1]: sssd-pac.socket: Deactivated successfully
/var/log/sssd/sssd_nss.log
(2026-07-13 11:42:50): [nss] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#240203] CR #7398902: Could not get account info [1432158212]: SSSD is offline
(2026-07-13 14:52:53): [nss] [cache_req_common_process_dp_reply] (0x3f7c0): CR #7696539: Could not get account info [1432158213]: Terminated
(2026-07-13 14:53:16): [nss] [server_setup] (0x3f7c0): Starting with debug level = 0x0070
(2026-07-13 14:53:25): [nss] [sbus_dbus_connect_address] (0x0020): Unable to register to unix:path=/var/lib/sss/pipes/private/sbus-dp_schule.schein.ig [org.freedesktop.DB
us.Error.NoReply]: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the r
eply timeout expired, or the network connection was broken.
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE:
file /var/lib/sss/pipes/private/sbus-dp_schule.schein.ig.2517050 /var/lib/sss/pipes/private/sbus-dp_schule.schein.ig.2517050: socket
Solution
Root cause was a crashed sssd service. A backtrace regarding the socket frome sbus-dp_schule.schein.ig. Auth.log showed a hint to sssd.
Restarting the sssd service fixed the issue.