[Freeipa-users] Re: Old users cannot login to new freeIPA client machine

[Sam Bell]

In addition, I am attaching the krb5kdc log for successful authentication on older client machine:

Mar 11 11:11:07 xpsserver.freeipa.lab krb5kdc[1225](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 192.168.0.244: NEEDED_PREAUTH: host/[e-mail] for krbtgt/[e-mail], Additional pre-authentication required
Mar 11 11:11:07 xpsserver.freeipa.lab krb5kdc[1225](info): closing down fd 11
Mar 11 11:11:07 xpsserver.freeipa.lab krb5kdc[1225](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 192.168.0.244: ISSUE: authtime 1615428667, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, host/[e-mail] for krbtgt/[e-mail]
Mar 11 11:11:07 xpsserver.freeipa.lab krb5kdc[1225](info): closing down fd 11
Mar 11 11:11:07 xpsserver.freeipa.lab krb5kdc[1225](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 192.168.0.244: NEEDED_PREAUTH: [e-mail] for krbtgt/[e-mail], Additional pre-authentication required
Mar 11 11:11:07 xpsserver.freeipa.lab krb5kdc[1225](info): closing down fd 11
Mar 11 11:11:07 xpsserver.freeipa.lab krb5kdc[1225](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 192.168.0.244: NEEDED_PREAUTH: [e-mail] for krbtgt/[e-mail], Additional pre-authentication required
Mar 11 11:11:07 xpsserver.freeipa.lab krb5kdc[1225](info): closing down fd 11
Mar 11 11:11:07 xpsserver.freeipa.lab krb5kdc[1225](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 192.168.0.244: ISSUE: authtime 1615428667, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, [e-mail] for krbtgt/[e-mail]
Mar 11 11:11:07 xpsserver.freeipa.lab krb5kdc[1225](info): closing down fd 11
Mar 11 11:11:07 xpsserver.freeipa.lab krb5kdc[1225](info): TGS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 192.168.0.244: ISSUE: authtime 1615428667, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, [e-mail] for host/[e-mail]
Mar 11 11:11:07 xpsserver.freeipa.lab krb5kdc[1225](info): closing down fd 11