[Freeipa-users] Re: Old users cannot login to new freeIPA client machine

[Sam Bell]

Yeah the password is right. 
On a separate note, on the client machine I had login problem on both Ubuntu(installed before)
and Fedora. So the problem could be with server.

For pre-authentication I used following commands:
# kadmin.local
kadmin.local: modprinc +requires_preauth testuser
Principal "[e-mail]" modified.

Server: xpsserver.freeipa.lab (fedora)
freeipa-server version: 4.9.2 (4.fc32)

client: mu3090x1.freeipa.lab
freeipa-client version: 4.9.2 (4.fc33)

Here's the log from krb5kdc.log from the server:

Mar 10 15:47:06 xpsserver.freeipa.lab krb5kdc[1225](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) 192.168.0.248: NEEDED_PREAUTH: [e-mail] for krbtgt/[e-mail], Additional pre-authentication required
Mar 10 15:47:06 xpsserver.freeipa.lab krb5kdc[1225](info): closing down fd 11
Mar 10 15:47:06 xpsserver.freeipa.lab krb5kdc[1223](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) 192.168.0.248: NEEDED_PREAUTH: [e-mail] for krbtgt/[e-mail], Additional pre-authentication required
Mar 10 15:47:06 xpsserver.freeipa.lab krb5kdc[1223](info): closing down fd 11
Mar 10 15:47:12 xpsserver.freeipa.lab krb5kdc[1223](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) 192.168.0.248: NEEDED_PREAUTH: [e-mail] for krbtgt/[e-mail], Additional pre-authentication required
Mar 10 15:47:12 xpsserver.freeipa.lab krb5kdc[1223](info): closing down fd 11
Mar 10 15:47:12 xpsserver.freeipa.lab krb5kdc[1225](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) 192.168.0.248: NEEDED_PREAUTH: [e-mail] for krbtgt/[e-mail], Additional pre-authentication required
Mar 10 15:47:12 xpsserver.freeipa.lab krb5kdc[1225](info): closing down fd 11
Mar 10 15:47:12 xpsserver.freeipa.lab krb5kdc[1220](info): preauth (spake) verify failure: Preauthentication failed
Mar 10 15:47:12 xpsserver.freeipa.lab krb5kdc[1220](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) 192.168.0.248: PREAUTH_FAILED: [e-mail] for krbtgt/[e-mail], Preauthentication failed
Mar 10 15:47:12 xpsserver.freeipa.lab krb5kdc[1220](info): closing down fd 11
Mar 10 15:47:14 xpsserver.freeipa.lab krb5kdc[1219](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) 192.168.0.248: NEEDED_PREAUTH: [e-mail] for krbtgt/[e-mail], Additional pre-authentication required
Mar 10 15:47:14 xpsserver.freeipa.lab krb5kdc[1219](info): closing down fd 11
Mar 10 15:47:14 xpsserver.freeipa.lab krb5kdc[1222](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) 192.168.0.248: NEEDED_PREAUTH: [e-mail] for krbtgt/[e-mail], Additional pre-authentication required
Mar 10 15:47:14 xpsserver.freeipa.lab krb5kdc[1222](info): closing down fd 11
Mar 10 15:47:20 xpsserver.freeipa.lab krb5kdc[1220](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) 192.168.0.248: NEEDED_PREAUTH: [e-mail] for krbtgt/[e-mail], Additional pre-authentication required
Mar 10 15:47:20 xpsserver.freeipa.lab krb5kdc[1220](info): closing down fd 11
Mar 10 15:47:20 xpsserver.freeipa.lab krb5kdc[1220](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) 192.168.0.248: NEEDED_PREAUTH: [e-mail] for krbtgt/[e-mail], Additional pre-authentication required
Mar 10 15:47:20 xpsserver.freeipa.lab krb5kdc[1220](info): closing down fd 11
Mar 10 15:47:20 xpsserver.freeipa.lab krb5kdc[1225](info): preauth (spake) verify failure: Preauthentication failed
Mar 10 15:47:20 xpsserver.freeipa.lab krb5kdc[1225](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) 192.168.0.248: PREAUTH_FAILED: [e-mail] for krbtgt/[e-mail], Preauthentication failed
Mar 10 15:47:20 xpsserver.freeipa.lab krb5kdc[1225](info): closing down fd 11
Mar 10 15:47:22 xpsserver.freeipa.lab krb5kdc[1225](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) 192.168.0.248: NEEDED_PREAUTH: [e-mail] for krbtgt/[e-mail], Additional pre-authentication required
Mar 10 15:47:22 xpsserver.freeipa.lab krb5kdc[1225](info): closing down fd 11
Mar 10 15:47:22 xpsserver.freeipa.lab krb5kdc[1225](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) 192.168.0.248: NEEDED_PREAUTH: [e-mail] for krbtgt/[e-mail], Additional pre-authentication required
Mar 10 15:47:22 xpsserver.freeipa.lab krb5kdc[1225](info): closing down fd 11