SSSD / sssd

#2204 sssd_ad kerberos passwords
Closed: Invalid Opened by hoeflerb.

Closed: Invalid
Reopen Issue

Hi,

I have provisioned a Samba4 domain to provide authentication for some Windows and Linux clients. For the Linux clients I am using sssd/realmd to join the domain and handle authentication (pam, nss). Everything seems to work pretty well, but the sssd_ad provider in the latest sssd 1.11.3 does not seem to handle expired passwords or password change requests.

The Kerberos is accessible,

$ host -t SRV _kerberos._udp.domain.local
_kerberos._udp.domain.local has SRV record 0 100 88 sirius.domain.local.
$ kinit test
Password for test@DOMAIN.LOCAL: 
Warning: Your password will expire in 349 days on Wed 07 Jan 2015 04:21:22 AM UTC
$ klist
(displays the ticket)

And can authenticate users,

admin@hostname$ su test
Password for test@DOMAIN.LOCAL: 
Warning: Your password will expire in 349 days on Wed 07 Jan 2015 04:21:22 AM UTC
test@hostname$

But a password change fails,

test@hostname$ passwd
Current Password: 
Password change failed. Server message: Old password not accepted.
passwd: Authentication token manipulation error
passwd: password unchanged

At debug_level = 6, there is not really an informative error message,

==> /var/log/sssd/krb5_child.log <==
(Wed Jan 22 18:40:01 2014) [[sssd[krb5_child[741]]]] [main] (0x0400): krb5_child started.
(Wed Jan 22 18:40:01 2014) [[sssd[krb5_child[741]]]] [unpack_buffer] (0x0100): cmd [247] uid [3003] gid [3000] validate [true] enterprise principal [true] offline [false] UPN [test@DOMAIN.LOCAL]
(Wed Jan 22 18:40:01 2014) [[sssd[krb5_child[741]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_3003_h9YWgV] keytab: [/etc/krb5.keytab]
(Wed Jan 22 18:40:01 2014) [[sssd[krb5_child[741]]]] [k5c_setup] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.
(Wed Jan 22 18:40:01 2014) [[sssd[krb5_child[741]]]] [k5c_setup] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.
(Wed Jan 22 18:40:01 2014) [[sssd[krb5_child[741]]]] [krb5_set_canonicalize] (0x0100): SSSD_KRB5_CANONICALIZE is set to [true]
(Wed Jan 22 18:40:01 2014) [[sssd[krb5_child[741]]]] [k5c_setup] (0x0100): Not using FAST.
(Wed Jan 22 18:40:01 2014) [[sssd[krb5_child[741]]]] [main] (0x0400): Will perform password change checks
(Wed Jan 22 18:40:01 2014) [[sssd[krb5_child[741]]]] [changepw_child] (0x0400): Attempting kinit for realm [DOMAIN.LOCAL]
(Wed Jan 22 18:40:01 2014) [[sssd[krb5_child[741]]]] [main] (0x0400): krb5_child completed successfully

I can workaround by using sssd_krb5,

==> /etc/sssd/sssd.conf <==
[domain/domain.local]
ad_domain = domain.local
krb5_realm = DOMAIN.LOCAL
id_provider = ad
auth_provider = krb5

Then password changing works,

test@hostname$ passwd
Current Password: 
New password: 
Retype new password: 
passwd: password updated successfully

And in the debug log,

==> /var/log/sssd/krb5_child.log <==
(Wed Jan 22 18:43:46 2014) [[sssd[krb5_child[792]]]] [main] (0x0400): krb5_child started.
(Wed Jan 22 18:43:46 2014) [[sssd[krb5_child[792]]]] [unpack_buffer] (0x0100): cmd [246] uid [3003] gid [3000] validate [false] enterprise principal [false] offline [false] UPN [test@DOMAIN.LOCAL]
(Wed Jan 22 18:43:46 2014) [[sssd[krb5_child[792]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_3003_PGyvi6] keytab: [/etc/krb5.keytab]
(Wed Jan 22 18:43:46 2014) [[sssd[krb5_child[792]]]] [k5c_setup] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.
(Wed Jan 22 18:43:46 2014) [[sssd[krb5_child[792]]]] [k5c_setup] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.
(Wed Jan 22 18:43:46 2014) [[sssd[krb5_child[792]]]] [krb5_set_canonicalize] (0x0100): SSSD_KRB5_CANONICALIZE is set to [false]
(Wed Jan 22 18:43:46 2014) [[sssd[krb5_child[792]]]] [k5c_setup] (0x0100): Not using FAST.
(Wed Jan 22 18:43:46 2014) [[sssd[krb5_child[792]]]] [main] (0x0400): Will perform password change
(Wed Jan 22 18:43:46 2014) [[sssd[krb5_child[792]]]] [changepw_child] (0x0400): Attempting kinit for realm [DOMAIN.LOCAL]
(Wed Jan 22 18:43:46 2014) [[sssd[krb5_child[792]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [DOMAIN.LOCAL]
(Wed Jan 22 18:43:46 2014) [[sssd[krb5_child[792]]]] [get_and_save_tgt] (0x0100): TGT validation is disabled.
(Wed Jan 22 18:43:46 2014) [[sssd[krb5_child[792]]]] [main] (0x0400): krb5_child completed successfully

The only difference I can see is the [get_and_save_tgt] steps when using auth_provider = krb5.

A consequence of this is that accounts with expired passwords also can't be handled by auth_provider = ad. Tagging as "minor" because auth_provider = krb5 is a decent workaround, but it seems auth_provider = ad should work.

It should work, we will double check. Workaround is not acceptable if you have trusted domains. Would be nice to see what your Kerberos logs have on the client and server in the AD provider case.

Hi,

I'm sorry you're having problems with AD provider. The two differences between AD provider and krb5 provider I can think about are validation and enterprise principals and I bet on validation. Otherwise they share the same code.

Would you mind testing with the AD provider again, but with setting:

krb5_validate = false

or

krb5_use_enterprise_principal = false

In sssd.conf?

Also if you set debug_level=10, you will see much more debug information, including some low level tracing messages from libkrb5.

Jakub,
I have a suspect that canonicalization may be a better suspect.
Does it make a difference if krb5_canonicalize is set to false with the ad provider ?

_comment0:
Jakub,
I have a suspect that canonicalization may be a better suspect.
Does it make a difference if krb5_canonicalize is set to false with teh ad provider ? => 1390431536631622

Hi All,

Thanks for the comments. Here is what I have been able to dig up.

[auth_provider = ad, debug_level = 10, user test@domain.local has an expired password]

localuser@domain_member$ su test
Password:
su: Authentication failure

==> /var/log/sssd/krb5_child.log <==

(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [main] (0x0400): krb5_child started.
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [unpack_buffer] (0x1000): total buffer size: [122]
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [unpack_buffer] (0x0100): cmd [241] uid [3002] gid [3000] validate [true] enterprise principal [true] offline [false] UPN [test@DOMAIN.LOCAL]
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_3002_XXXXXX] keytab: [/etc/krb5.keytab]
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [k5c_setup] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [k5c_setup] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [krb5_set_canonicalize] (0x0100): SSSD_KRB5_CANONICALIZE is set to [true]
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [k5c_setup] (0x0100): Not using FAST.
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [main] (0x0400): Will perform online auth
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [tgt_req_child] (0x1000): Attempting to get a TGT
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [DOMAIN.LOCAL]
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.735628: Getting initial credentials for test\@DOMAIN.LOCAL@DOMAIN.LOCAL
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.735755: Sending request (194 bytes) to DOMAIN.LOCAL
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.737010: Resolving hostname sirius.domain.local.
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.738049: Sending initial UDP request to dgram 165.91.50.154:88
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.740651: Received answer from dgram 165.91.50.154:88
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.741139: Response was not from master KDC
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.741196: Received error from KDC: -1765328359/Additional pre-authentication required
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.741263: Processing preauth types: 16, 15, 2, 11, 19
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.741288: Selected etype info: etype rc4-hmac, salt "", params ""
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.741334: AS key obtained for encrypted timestamp: rc4-hmac/3614
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.741388: Encrypted timestamp (for 1390451341.740547): plain 301AA011180F32303134303132333034323930315AA10502030B4CC3, encrypted 68618819F7E8E227E17CBD277811883FCB372C30E908BDF97ADD3CB4A392257AEB329DE6B4A3F54417E0CB3AA311CC1C50668EA1
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.741411: Preauth module encrypted_timestamp (2) (flags=1) returned: 0/Success
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.741425: Produced preauth for next request: 2
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.741449: Sending request (270 bytes) to DOMAIN.LOCAL
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.742009: Resolving hostname sirius.domain.local.
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.742524: Sending initial UDP request to dgram 165.91.50.154:88
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.744577: Received answer from dgram 165.91.50.154:88
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.744967: Response was not from master KDC
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.745006: Received error from KDC: -1765328361/Password has expired
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.745034: Preauth tryagain input types: 16, 15, 2, 11, 19
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.745054: Retrying AS request with master KDC
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.745070: Getting initial credentials for test\@DOMAIN.LOCAL@DOMAIN.LOCAL
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.745115: Sending request (194 bytes) to DOMAIN.LOCAL (master)
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [get_and_save_tgt] (0x0020): 918: [-1765328361][Password has expired]
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [tgt_req_child] (0x1000): Password was expired
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.745622: Getting initial credentials for test\@DOMAIN.LOCAL@DOMAIN.LOCAL
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.745651: Setting initial creds service to kadmin/changepw
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.745683: Sending request (185 bytes) to DOMAIN.LOCAL
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.746202: Resolving hostname sirius.domain.local.
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.746716: Sending initial UDP request to dgram 165.91.50.154:88
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.749522: Received answer from dgram 165.91.50.154:88
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.749903: Response was not from master KDC
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.749940: Received error from KDC: -1765328359/Additional pre-authentication required
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.749975: Processing preauth types: 16, 15, 2, 11, 19
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.749991: Selected etype info: etype rc4-hmac, salt "", params ""
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.750014: AS key obtained for encrypted timestamp: rc4-hmac/3614
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.750055: Encrypted timestamp (for 1390451341.749481): plain 301AA011180F32303134303132333034323930315AA10502030B6FA9, encrypted 3E2DD0D723513EC671D207F4098108D34C9DCAF09DBD90934CBBDB92D0451E088977E8B16F9FCEED005C267DE7EDC76B6F903E30
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.750075: Preauth module encrypted_timestamp (2) (flags=1) returned: 0/Success
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.750089: Produced preauth for next request: 2
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.750110: Sending request (260 bytes) to DOMAIN.LOCAL
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.750647: Resolving hostname sirius.domain.local.
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.751136: Sending initial UDP request to dgram 165.91.50.154:88
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.755349: Received answer from dgram 165.91.50.154:88
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.755748: Response was not from master KDC
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.755789: Salt derived from principal: DOMAIN.LOCALtest
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.755808: AS key determined by preauth: rc4-hmac/3614
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.755852: Decrypted AS reply; session key is: rc4-hmac/6209
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.755866: FAST negotiation: unavailable
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.755886: Retrying AS request with master KDC
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.755900: Getting initial credentials for test\@DOMAIN.LOCAL@DOMAIN.LOCAL
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.755927: Setting initial creds service to kadmin/changepw
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [sss_child_krb5_trace_cb] (0x4000): [618] 1390451341.755958: Sending request (185 bytes) to DOMAIN.LOCAL (master)
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [map_krb5_error] (0x0020): 979: [-1765328237][KDC reply did not match expectations]
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [pack_response_packet] (0x2000): response packet size: [4]
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [k5c_send_data] (0x4000): Response sent.
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [main] (0x0400): krb5_child completed successfully

==> on the domain controller <==

[2014/01/23 04:56:02.322515,  3] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect)
  ldb_wrap open of secrets.ldb
[2014/01/23 04:56:02.342229,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ SEQRETE$@DOMAIN.LOCAL from ipv4:165.91.50.158:40416 for krbtgt/DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.349326,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 149
[2014/01/23 04:56:02.349408,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- SEQRETE$@DOMAIN.LOCAL
[2014/01/23 04:56:02.349440,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- SEQRETE$@DOMAIN.LOCAL
[2014/01/23 04:56:02.349564,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- SEQRETE$@DOMAIN.LOCAL
[2014/01/23 04:56:02.352514,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ SEQRETE$@DOMAIN.LOCAL from ipv4:165.91.50.158:39817 for krbtgt/DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.355604,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 149
[2014/01/23 04:56:02.355653,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- SEQRETE$@DOMAIN.LOCAL
[2014/01/23 04:56:02.355686,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- SEQRETE$@DOMAIN.LOCAL
[2014/01/23 04:56:02.356138,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- SEQRETE$@DOMAIN.LOCAL using arcfour-hmac-md5
[2014/01/23 04:56:02.357525,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ authtime: 2014-01-23T04:56:02 starttime: unset endtime: 2014-01-23T14:56:02 renew till: 2014-01-24T04:56:02
[2014/01/23 04:56:02.357657,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, arcfour-hmac-md5, des3-cbc-sha1, 25, 26, using arcfour-hmac-md5/arcfour-hmac-md5
[2014/01/23 04:56:02.357721,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Requested flags: renewable-ok
[2014/01/23 04:56:02.364006,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: TGS-REQ SEQRETE$@DOMAIN.LOCAL from ipv4:165.91.50.158:36522 for ldap/sirius.domain.local@DOMAIN.LOCAL [canonicalize, renewable]
[2014/01/23 04:56:02.368703,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: TGS-REQ authtime: 2014-01-23T04:56:02 starttime: 2014-01-23T04:56:02 endtime: 2014-01-23T14:56:02 renew till: 2014-01-24T04:56:02
[2014/01/23 04:56:02.369221,  3] ../source4/smbd/service_stream.c:66(stream_terminate_connection)
  Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2014/01/23 04:56:02.369298,  3] ../source4/smbd/process_single.c:114(single_terminate)
  single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED]
[2014/01/23 04:56:02.405092,  3] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect)
  ldb_wrap open of secrets.ldb
[2014/01/23 04:56:02.421733,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ SEQRETE$@DOMAIN.LOCAL from ipv4:165.91.50.158:41728 for krbtgt/DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.424848,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 149
[2014/01/23 04:56:02.424896,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- SEQRETE$@DOMAIN.LOCAL
[2014/01/23 04:56:02.424926,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- SEQRETE$@DOMAIN.LOCAL
[2014/01/23 04:56:02.424976,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- SEQRETE$@DOMAIN.LOCAL
[2014/01/23 04:56:02.427594,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ SEQRETE$@DOMAIN.LOCAL from ipv4:165.91.50.158:45359 for krbtgt/DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.430441,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 149
[2014/01/23 04:56:02.430488,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- SEQRETE$@DOMAIN.LOCAL
[2014/01/23 04:56:02.430518,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- SEQRETE$@DOMAIN.LOCAL
[2014/01/23 04:56:02.430599,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- SEQRETE$@DOMAIN.LOCAL using arcfour-hmac-md5
[2014/01/23 04:56:02.431242,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ authtime: 2014-01-23T04:56:02 starttime: unset endtime: 2014-01-23T14:56:02 renew till: 2014-01-24T04:56:02
[2014/01/23 04:56:02.431328,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, arcfour-hmac-md5, des3-cbc-sha1, 25, 26, using arcfour-hmac-md5/arcfour-hmac-md5
[2014/01/23 04:56:02.431365,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Requested flags: renewable-ok
[2014/01/23 04:56:02.437034,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: TGS-REQ SEQRETE$@DOMAIN.LOCAL from ipv4:165.91.50.158:36524 for ldap/sirius.domain.local@DOMAIN.LOCAL [canonicalize, renewable]
[2014/01/23 04:56:02.441339,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: TGS-REQ authtime: 2014-01-23T04:56:02 starttime: 2014-01-23T04:56:02 endtime: 2014-01-23T14:56:02 renew till: 2014-01-24T04:56:02
[2014/01/23 04:56:02.441759,  3] ../source4/smbd/service_stream.c:66(stream_terminate_connection)
  Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2014/01/23 04:56:02.441816,  3] ../source4/smbd/process_single.c:114(single_terminate)
  single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED]
[2014/01/23 04:56:02.480070,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ test\@DOMAIN.LOCAL@DOMAIN.LOCAL from ipv4:165.91.50.158:45308 for krbtgt/DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.482082,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 149
[2014/01/23 04:56:02.482131,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- test\@DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.482162,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- test\@DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.482212,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- test\@DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.484777,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ test\@DOMAIN.LOCAL@DOMAIN.LOCAL from ipv4:165.91.50.158:41909 for krbtgt/DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.486438,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 149
[2014/01/23 04:56:02.486480,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- test\@DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.486511,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- test\@DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.486591,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- test\@DOMAIN.LOCAL@DOMAIN.LOCAL using arcfour-hmac-md5
[2014/01/23 04:56:02.486638,  2] ../source4/auth/sam.c:207(authsam_account_ok)
  sam_account_ok: Account for user 'test\@DOMAIN.LOCAL@DOMAIN.LOCAL' password must change!.
[2014/01/23 04:56:02.489093,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ test\@DOMAIN.LOCAL@DOMAIN.LOCAL from ipv4:165.91.50.158:46981 for kadmin/changepw@DOMAIN.LOCAL
[2014/01/23 04:56:02.491660,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 149
[2014/01/23 04:56:02.491701,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- test\@DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.491732,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- test\@DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.491778,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: No preauth found, returning PREAUTH-REQUIRED -- test\@DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.493623,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ test\@DOMAIN.LOCAL@DOMAIN.LOCAL from ipv4:165.91.50.158:54521 for kadmin/changepw@DOMAIN.LOCAL
[2014/01/23 04:56:02.496106,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: encrypted-timestamp, 149
[2014/01/23 04:56:02.496148,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PKINIT pa-data -- test\@DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.496179,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data -- test\@DOMAIN.LOCAL@DOMAIN.LOCAL
[2014/01/23 04:56:02.496256,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- test\@DOMAIN.LOCAL@DOMAIN.LOCAL using arcfour-hmac-md5
[2014/01/23 04:56:02.497674,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ authtime: 2014-01-23T04:56:02 starttime: unset endtime: 2014-01-23T05:01:02 renew till: unset
[2014/01/23 04:56:02.497771,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, arcfour-hmac-md5, 25, 26, using arcfour-hmac-md5/arcfour-hmac-md5
[2014/01/23 04:56:02.497808,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Requested flags: renewable-ok

[same as above with krb5_validate = false]

localuser@domain_member:~$ su test
Password:
su: Authentication failure

[same as above with krb5_canonicalize = false]

localuser@domain_member:~$ su test
Password:
su: Authentication failure

[same as above with krb5_use_enterprise_principal = false]

This one works!

localuser@domain_member:~$ su test
Password:
Password expired. Change your password now.
Current Password:
New password:
Retype new password:
test@domain_member:$

This option I can't find documented anywhere. Can somebody please explain what it does?

Replying to [comment:3 simo]:

Jakub,
I have a suspect that canonicalization may be a better suspect.
Does it make a difference if krb5_canonicalize is set to false with the ad provider ?

enterprise principals imply krb5_canonicalize in the code.

 
(Thu Jan 23 04:29:01 2014) [[sssd[krb5_child[618]]]] [map_krb5_error] (0x0020): 979: [-1765328237][KDC reply did not match expectations]

indicates some mismatch. I tested an expired password with AD and it was working as expected. I think if you can capture the Kerberos packets going over the network would help. If you do not want to attach the trace here feel free to send it to me directly.

Btw, the next steps I see when talking to AD is to switch from UDP to TCP because the packets become to big.

I can send it. What's your email? Is there any information in particular you want?

I just did,

tcpdump -n -p -s 0 -w capture \(host sirius.tamu.edu or host seqrete.tamu.edu or host sirius.straightlab.local\) and \(port 389 or port 88 or port 53 or port 135 or port 137 or port 138 or port 139 or port 445 or port 464 or port 636 or portrange 1024-5000 or port 3268 or port 3269 or port 5353\)

Replying to [comment:7 hoeflerb]:

I can send it. What's your email? Is there any information in particular you want?

sorry for the delay, please send it to sbose@redhat.com

I just did,
{{{
tcpdump -n -p -s 0 -w capture (host sirius.tamu.edu or host seqrete.tamu.edu or host sirius.straightlab.local) and (port 389 or port 88 or port 53 or port 135 or port 137 or port 138 or port 139 or port 445 or port 464 or port 636 or portrange 1024-5000 or port 3268 or port 3269 or port 5353)
}}}

Thank you for the logs they helped to understand what is going on.

The reason of the failure is that if krb5_use_enterprise_principal=true we send the enterprise principal when trying to get the TGT to change the password but canonicalization is disabled permanently here because of #1405.

This is working well with AD because AD puts the same enterprise principal in the response. AD only puts the right canonicalized principal in the response if canonicalization is enabled.

The samba4 KDC returns the canonicalized principal here which is ok because it can implicitly assumed that when using enterprise principals you want the right principal in the response. But the MIT Kerberos client library only allows a change in the principal if canonicalization is enabled in the request. This is why you see the 'KDC reply did not match expectations' error message.

I'm currently not sure what the right solution would be here. I will do some testing with different configuration against samba4 and AD and will also talk the MIT Kerberos developers to see if the error is justified when using enterprise principals.

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.12 beta
rhbz: => todo

Fields changed

review: 0 => 1

Might be solved better when Samba adopts MIT Kerberos.

milestone: SSSD 1.12 beta => SSSD 1.13 beta

Fields changed

mark: => 0

Fields changed

milestone: SSSD 1.13 beta => SSSD 1.13 backlog
priority: minor => trivial

Mass-moving tickets not planned for any immediate release and re-setting priority.

milestone: SSSD 1.13 backlog => SSSD Deferred
priority: trivial => major

Please reopen if this is still the case with a recent sssd release and a recent samba4 server.

resolution: => invalid
sensitive: => 0
status: new => closed

Metadata Update from @hoeflerb:
- Issue set to the milestone: SSSD Patches welcome

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3246

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
Normal
defect
SSSD
1.11.3
todo
0
0
0
1
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.