[Freeipa-users] Re: Auth issue on a specific service

[Robbie Harwood]

Sylvain Coutant via FreeIPA-users 
writes:
> Sep 19 15:57:00 ds-01.auth.example.com krb5kdc[1451](info): AS_REQ (8
> etypes {18 17 20 19 16 23 25 26}) x.x.x.x: NEEDED_PREAUTH:
> [e-mail] for krbtgt/[e-mail],
> Additional pre-authentication required
> Sep 19 15:57:00 ds-01.auth.example.com krb5kdc[1451](info): closing down fd
> 11
> Sep 19 15:57:00 ds-01.auth.example.com krb5kdc[1452](info): AS_REQ (8
> etypes {18 17 20 19 16 23 25 26}) x.x.x.x: NEEDED_PREAUTH:
> [e-mail] for krbtgt/[e-mail],
> Additional pre-authentication required
> Sep 19 15:57:00 ds-01.auth.example.com krb5kdc[1452](info): closing down fd
> 11
> Sep 19 15:57:00 ds-01.auth.example.com krb5kdc[1451](info): preauth
> (encrypted_challenge) verify failure: Incorrect password in encrypted
> challenge
> Sep 19 15:57:00 ds-01.auth.example.com krb5kdc[1451](info): AS_REQ (8
> etypes {18 17 20 19 16 23 25 26}) x.x.x.x: PREAUTH_FAILED:
> [e-mail] for krbtgt/[e-mail],
> Incorrect password in encrypted challenge
> Sep 19 15:57:00 ds-01.auth.example.com krb5kdc[1451](info): closing down fd
> 11
>
> Guess what ? Whatever it says, the password I use for this auth should be
> right ... ;)

How sure are you?  All the krb logs suggest the password is wrong.  Can
you kinit?

Thanks,
--Robbie