kpasswd: Preauthentication failed getting initial ticket

[lune voo]

Hello !

I contact you because I encounter a problem when I use kpasswd using python
popen function.
I use freeipa 3.0 and python 2.6.6.

Here is what I do in python :

input_process = otp + '\n' + password + '\n' + password
cmd = 'kpasswd %s' % user_login
cmd_and_args = shlex.split(cmd)
p = Popen(cmd_and_args, stdout=PIPE, stdin=PIPE, stderr=STDOUT)
(output, error) = p.communicate(input=input_process)


Before doing that, I performed the following command in order to have more
logs :
export KRB5_TRACE=/dev/stdout

And here is what I see in the logs :
###
[47700] 1530630765.610794: Getting initial credentials for test_user@MYREALM
[47700] 1530630765.610945: FAST armor ccache: FILE:/tmp/krb5cc_testuser
[47700] 1530630765.610998: Retrieving admin@MYREALM ->
krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF: from
FILE:/tmp/krb5cc_testuser with result: 0/Success
[47700] 1530630765.611003: Read config in FILE:/tmp/krb5cc_testuser for
krbtgt/MYREALM@MYREALM: fast_avail: yes
[47700] 1530630765.611006: Using FAST due to armor ccache negotiation result
[47700] 1530630765.611016: Getting credentials admin@MYREALM ->
krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
[47700] 1530630765.611044: Retrieving admin@MYREALM ->
krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result: 0/Success
[47700] 1530630765.611061: Armor ccache sesion key: aes256-cts/2559
[47700] 1530630765.611089: Creating authenticator for admin@MYREALM ->
krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/7F39, session key
aes256-cts/2559
[47700] 1530630765.611168: FAST armor key: aes256-cts/79AB
[47700] 1530630765.611179: Setting initial creds service to kadmin/changepw
[47700] 1530630765.611184: FAST armor ccache: FILE:/tmp/krb5cc_testuser
[47700] 1530630765.611208: Retrieving admin@MYREALM ->
krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF: from
FILE:/tmp/krb5cc_testuser with result: 0/Success
[47700] 1530630765.611212: Read config in FILE:/tmp/krb5cc_testuser for
krbtgt/MYREALM@MYREALM: fast_avail: yes
[47700] 1530630765.611213: Using FAST due to armor ccache negotiation result
[47700] 1530630765.611219: Getting credentials admin@MYREALM ->
krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
[47700] 1530630765.611240: Retrieving admin@MYREALM ->
krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result: 0/Success
[47700] 1530630765.611245: Armor ccache sesion key: aes256-cts/2559
[47700] 1530630765.611256: Creating authenticator for admin@MYREALM ->
krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/2BFD, session key
aes256-cts/2559
[47700] 1530630765.611288: FAST armor key: aes256-cts/62C4
[47700] 1530630765.611299: Encoding request body and padata into FAST
request
[47700] 1530630765.611333: Sending request (1019 bytes) to MYREALM
[47700] 1530630765.611418: Resolving hostname ipamasterhostname
[47700] 1530630765.611608: Initiating TCP connection to stream
ipamasterIP:88
[47700] 1530630765.611769: Sending TCP request to stream ipamasterIP:88
[47700] 1530630765.675154: Received answer from stream ipamasterIP:88
[47700] 1530630765.675208: Response was from master KDC
[47700] 1530630765.675238: Received error from KDC: -1765328359/Additional
pre-authentication required
[47700] 1530630765.675249: Decoding FAST response
[47700] 1530630765.675311: Processing preauth types: 136, 19, 138, 133, 137
[47700] 1530630765.675319: Received cookie: MIT
Password for test_user@MYREALM: [47700] 1530630765.682884: Preauth module
encrypted_challenge (138) (flags=1) returned: 0/Success
[47700] 1530630765.682889: Produced preauth for next request: 133, 138
[47700] 1530630765.682891: Encoding request body and padata into FAST
request
[47700] 1530630765.682951: Sending request (1118 bytes) to MYREALM
[47700] 1530630765.682967: Resolving hostname ipamasterhostname
[47700] 1530630765.683098: Initiating TCP connection to stream
ipamasterIP:88
[47700] 1530630765.683180: Sending TCP request to stream ipamasterIP:88
[47700] 1530630765.756232: Received answer from stream ipamasterIP:88
[47700] 1530630765.756302: Response was from master KDC
[47700] 1530630765.756321: Received error from KDC:
-1765328360/Preauthentication failed
[47700] 1530630765.756325: Decoding FAST response
[47700] 1530630765.756376: Preauth tryagain input types: 136, 19, 138, 133,
137
kpasswd: Preauthentication failed getting initial ticket

)
###

I don't understand yet why the commande kpasswd is failing ?

My ticket admin is good.
My ticket cache is used only by me.

May you help me to understand what is going on please ?
Is there a way to use ipa python library to perform a kpasswd instead of
popen of kpasswd command ?

Best regards.

Lune

[Alexander Bokovoy]

On ti, 03 heinä 2018, lune voo via FreeIPA-users wrote:
> Hello !
>
> I contact you because I encounter a problem when I use kpasswd using python
> popen function.
> I use freeipa 3.0 and python 2.6.6.
>
> Here is what I do in python :
>
> input_process = otp + '\n' + password + '\n' + password 
Here you
provide otp (what is this? A 2FA token value?), password and
password.

> cmd = 'kpasswd %s' % user_login
> cmd_and_args = shlex.split(cmd)
> p = Popen(cmd_and_args, stdout=PIPE, stdin=PIPE, stderr=STDOUT)
> (output, error) = p.communicate(input=input_process)
>
>
> Before doing that, I performed the following command in order to have more
> logs :
> export KRB5_TRACE=/dev/stdout
>
> And here is what I see in the logs :
> ###
> [47700] 1530630765.610794: Getting initial credentials for test_user@MYREALM
> [47700] 1530630765.610945: FAST armor ccache: FILE:/tmp/krb5cc_testuser
> [47700] 1530630765.610998: Retrieving admin@MYREALM ->
> krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF: from
> FILE:/tmp/krb5cc_testuser with result: 0/Success
> [47700] 1530630765.611003: Read config in FILE:/tmp/krb5cc_testuser for
> krbtgt/MYREALM@MYREALM: fast_avail: yes
> [47700] 1530630765.611006: Using FAST due to armor ccache negotiation result
> [47700] 1530630765.611016: Getting credentials admin@MYREALM ->
> krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
> [47700] 1530630765.611044: Retrieving admin@MYREALM ->
> krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result: 0/Success
> [47700] 1530630765.611061: Armor ccache sesion key: aes256-cts/2559
> [47700] 1530630765.611089: Creating authenticator for admin@MYREALM ->
> krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/7F39, session key
> aes256-cts/2559
> [47700] 1530630765.611168: FAST armor key: aes256-cts/79AB
> [47700] 1530630765.611179: Setting initial creds service to kadmin/changepw
> [47700] 1530630765.611184: FAST armor ccache: FILE:/tmp/krb5cc_testuser
> [47700] 1530630765.611208: Retrieving admin@MYREALM ->
> krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF: from
> FILE:/tmp/krb5cc_testuser with result: 0/Success
> [47700] 1530630765.611212: Read config in FILE:/tmp/krb5cc_testuser for
> krbtgt/MYREALM@MYREALM: fast_avail: yes
> [47700] 1530630765.611213: Using FAST due to armor ccache negotiation result
> [47700] 1530630765.611219: Getting credentials admin@MYREALM ->
> krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
> [47700] 1530630765.611240: Retrieving admin@MYREALM ->
> krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result: 0/Success
> [47700] 1530630765.611245: Armor ccache sesion key: aes256-cts/2559
> [47700] 1530630765.611256: Creating authenticator for admin@MYREALM ->
> krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/2BFD, session key
> aes256-cts/2559
> [47700] 1530630765.611288: FAST armor key: aes256-cts/62C4
> [47700] 1530630765.611299: Encoding request body and padata into FAST
> request
> [47700] 1530630765.611333: Sending request (1019 bytes) to MYREALM
> [47700] 1530630765.611418: Resolving hostname ipamasterhostname
> [47700] 1530630765.611608: Initiating TCP connection to stream
> ipamasterIP:88
> [47700] 1530630765.611769: Sending TCP request to stream ipamasterIP:88
> [47700] 1530630765.675154: Received answer from stream ipamasterIP:88
> [47700] 1530630765.675208: Response was from master KDC
> [47700] 1530630765.675238: Received error from KDC: -1765328359/Additional
> pre-authentication required
> [47700] 1530630765.675249: Decoding FAST response
> [47700] 1530630765.675311: Processing preauth types: 136, 19, 138, 133, 137
> [47700] 1530630765.675319: Received cookie: MIT
> Password for test_user@MYREALM:  
Here you are asked for a password.

> [47700] 1530630765.682884: Preauth module
> encrypted_challenge (138) (flags=1) returned: 0/Success
> [47700] 1530630765.682889: Produced preauth for next request: 133, 138
> [47700] 1530630765.682891: Encoding request body and padata into FAST
> request
> [47700] 1530630765.682951: Sending request (1118 bytes) to MYREALM
> [47700] 1530630765.682967: Resolving hostname ipamasterhostname
> [47700] 1530630765.683098: Initiating TCP connection to stream
> ipamasterIP:88
> [47700] 1530630765.683180: Sending TCP request to stream ipamasterIP:88
> [47700] 1530630765.756232: Received answer from stream ipamasterIP:88
> [47700] 1530630765.756302: Response was from master KDC
> [47700] 1530630765.756321: Received error from KDC:
> -1765328360/Preauthentication failed
> [47700] 1530630765.756325: Decoding FAST response
> [47700] 1530630765.756376: Preauth tryagain input types: 136, 19, 138, 133,
> 137
> kpasswd: Preauthentication failed getting initial ticket 
And your password (what
kpasswd uses as a password) is incorrect (to
what KDC considers you have as a password).

> )
> ###
>
> I don't understand yet why the commande kpasswd is failing ?
>
> My ticket admin is good.
> My ticket cache is used only by me.
>
> May you help me to understand what is going on please ? 
Try first to get this
working interactively.

> Is there a way to use ipa python library to perform a kpasswd instead
> of
> popen of kpasswd command ?
>
> Best regards.
>
> Lune 
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]...

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[lune voo]

Hello Alexander.

Thanks for the answer.

Otp stands for one time password.

In fact in order to set a password for a user, I do first a ipa passwd
using ipa python library.

The otp is good normally.

And the kpasswd password should be good also except if ipa kdc dont like
some special characters ?

Lune.


Le mar. 3 juil. 2018 à 17:49, Alexander Bokovoy <abokovoy(a)redhat.com&gt; a
écrit :

>  On ti, 03 heinä 2018, lune voo via FreeIPA-users wrote:
>  >Hello !
>  >
>  >I contact you because I encounter a problem when I use kpasswd using
>  python
>  >popen function.
>  >I use freeipa 3.0 and python 2.6.6.
>  >
>  >Here is what I do in python :
>  >
>  >input_process = otp + '\n' + password + '\n' + password
>  Here you provide otp (what is this? A 2FA token value?), password and
>  password.
>
>  >cmd = 'kpasswd %s' % user_login
>  >cmd_and_args = shlex.split(cmd)
>  >p = Popen(cmd_and_args, stdout=PIPE, stdin=PIPE, stderr=STDOUT)
>  >(output, error) = p.communicate(input=input_process)
>  >
>  >
>  >Before doing that, I performed the following command in order to have more
>  >logs :
>  >export KRB5_TRACE=/dev/stdout
>  >
>  >And here is what I see in the logs :
>  >###
>  >[47700] 1530630765.610794: Getting initial credentials for
>  test_user@MYREALM
>  >[47700] 1530630765.610945: FAST armor ccache: FILE:/tmp/krb5cc_testuser
>  >[47700] 1530630765.610998: Retrieving admin@MYREALM ->
>  >krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF:
>  from
>  >FILE:/tmp/krb5cc_testuser with result: 0/Success
>  >[47700] 1530630765.611003: Read config in FILE:/tmp/krb5cc_testuser for
>  >krbtgt/MYREALM@MYREALM: fast_avail: yes
>  >[47700] 1530630765.611006: Using FAST due to armor ccache negotiation
>  result
>  >[47700] 1530630765.611016: Getting credentials admin@MYREALM ->
>  >krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
>  >[47700] 1530630765.611044: Retrieving admin@MYREALM ->
>  >krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result:
>  0/Success
>  >[47700] 1530630765.611061: Armor ccache sesion key: aes256-cts/2559
>  >[47700] 1530630765.611089: Creating authenticator for admin@MYREALM ->
>  >krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/7F39, session key
>  >aes256-cts/2559
>  >[47700] 1530630765.611168: FAST armor key: aes256-cts/79AB
>  >[47700] 1530630765.611179: Setting initial creds service to
>  kadmin/changepw
>  >[47700] 1530630765.611184: FAST armor ccache: FILE:/tmp/krb5cc_testuser
>  >[47700] 1530630765.611208: Retrieving admin@MYREALM ->
>  >krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF:
>  from
>  >FILE:/tmp/krb5cc_testuser with result: 0/Success
>  >[47700] 1530630765.611212: Read config in FILE:/tmp/krb5cc_testuser for
>  >krbtgt/MYREALM@MYREALM: fast_avail: yes
>  >[47700] 1530630765.611213: Using FAST due to armor ccache negotiation
>  result
>  >[47700] 1530630765.611219: Getting credentials admin@MYREALM ->
>  >krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
>  >[47700] 1530630765.611240: Retrieving admin@MYREALM ->
>  >krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result:
>  0/Success
>  >[47700] 1530630765.611245: Armor ccache sesion key: aes256-cts/2559
>  >[47700] 1530630765.611256: Creating authenticator for admin@MYREALM ->
>  >krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/2BFD, session key
>  >aes256-cts/2559
>  >[47700] 1530630765.611288: FAST armor key: aes256-cts/62C4
>  >[47700] 1530630765.611299: Encoding request body and padata into FAST
>  >request
>  >[47700] 1530630765.611333: Sending request (1019 bytes) to MYREALM
>  >[47700] 1530630765.611418: Resolving hostname ipamasterhostname
>  >[47700] 1530630765.611608: Initiating TCP connection to stream
>  >ipamasterIP:88
>  >[47700] 1530630765.611769: Sending TCP request to stream ipamasterIP:88
>  >[47700] 1530630765.675154: Received answer from stream ipamasterIP:88
>  >[47700] 1530630765.675208: Response was from master KDC
>  >[47700] 1530630765.675238: Received error from KDC: -1765328359/Additional
>  >pre-authentication required
>  >[47700] 1530630765.675249: Decoding FAST response
>  >[47700] 1530630765.675311: Processing preauth types: 136, 19, 138, 133,
>  137
>  >[47700] 1530630765.675319: Received cookie: MIT
>  >Password for test_user@MYREALM:
>  Here you are asked for a password.
>
>  >[47700] 1530630765.682884: Preauth module
>  >encrypted_challenge (138) (flags=1) returned: 0/Success
>  >[47700] 1530630765.682889: Produced preauth for next request: 133, 138
>  >[47700] 1530630765.682891: Encoding request body and padata into FAST
>  >request
>  >[47700] 1530630765.682951: Sending request (1118 bytes) to MYREALM
>  >[47700] 1530630765.682967: Resolving hostname ipamasterhostname
>  >[47700] 1530630765.683098: Initiating TCP connection to stream
>  >ipamasterIP:88
>  >[47700] 1530630765.683180: Sending TCP request to stream ipamasterIP:88
>  >[47700] 1530630765.756232: Received answer from stream ipamasterIP:88
>  >[47700] 1530630765.756302: Response was from master KDC
>  >[47700] 1530630765.756321: Received error from KDC:
>  >-1765328360/Preauthentication failed
>  >[47700] 1530630765.756325: Decoding FAST response
>  >[47700] 1530630765.756376: Preauth tryagain input types: 136, 19, 138,
>  133,
>  >137
>  >kpasswd: Preauthentication failed getting initial ticket
>  And your password (what kpasswd uses as a password) is incorrect (to
>  what KDC considers you have as a password).
>
>  >
>  >)
>  >###
>  >
>  >I don't understand yet why the commande kpasswd is failing ?
>  >
>  >My ticket admin is good.
>  >My ticket cache is used only by me.
>  >
>  >May you help me to understand what is going on please ?
>  Try first to get this working interactively.
>
>  >Is there a way to use ipa python library to perform a kpasswd instead of
>  >popen of kpasswd command ?
>  >
>  >Best regards.
>  >
>  >Lune
>
>  >_______________________________________________
>  >FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  >To unsubscribe send an email to
>  freeipa-users-leave(a)lists.fedorahosted.org
>  >Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  >List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  >List Archives:
>
> https://lists.fedoraproject.org/archives/list/[e-mail]...
>
>
>  --
>  / Alexander Bokovoy
>  Sr. Principal Software Engineer
>  Security / Identity Management Engineering
>  Red Hat Limited, Finland
>

[Alexander Bokovoy]

On ke, 04 heinä 2018, lune voo wrote:
> Hello Alexander.
>
> Thanks for the answer.
>
> Otp stands for one time password.
>
> In fact in order to set a password for a user, I do first a ipa passwd
> using ipa python library. 
So, your code is equivalent to

kinit admin
ipa passwd test-user
kpasswd test-user

?

I.e. there is no 2FA involved and what you call 'otp' is only reflecting
the fact that any non-user-initiated password change forces that user to
change their password, so 'ipa passwd test-user' as admin means
'test-user' password has to be changed and becomes effectively a one
time password set by admin.

Is that a correct assessment?


> The otp is good normally. 
Can you demonstrate things not working
in a console, interactively?

> And the kpasswd password should be good also except if ipa kdc dont
> like
> some special characters ? 
There is no limits on what Kerberos KDC considers a
'password' as that
could be a bunch of random bytes.

> Lune.
>
>
> Le mar. 3 juil. 2018 à 17:49, Alexander Bokovoy <abokovoy(a)redhat.com&gt; a
> écrit :
>
> > On ti, 03 heinä 2018, lune voo via FreeIPA-users wrote:
> > >Hello !
> > >
> > >I contact you because I encounter a problem when I use kpasswd using
> > python
> > >popen function.
> > >I use freeipa 3.0 and python 2.6.6.
> > >
> > >Here is what I do in python :
> > >
> > >input_process = otp + '\n' + password + '\n' + password
> > Here you provide otp (what is this? A 2FA token value?), password and
> > password.
> >
> > >cmd = 'kpasswd %s' % user_login
> > >cmd_and_args = shlex.split(cmd)
> > >p = Popen(cmd_and_args, stdout=PIPE, stdin=PIPE, stderr=STDOUT)
> > >(output, error) = p.communicate(input=input_process)
> > >
> > >
> > >Before doing that, I performed the following command in order to have more
> > >logs :
> > >export KRB5_TRACE=/dev/stdout
> > >
> > >And here is what I see in the logs :
> > >###
> > >[47700] 1530630765.610794: Getting initial credentials for
> > test_user@MYREALM
> > >[47700] 1530630765.610945: FAST armor ccache: FILE:/tmp/krb5cc_testuser
> > >[47700] 1530630765.610998: Retrieving admin@MYREALM ->
> > >krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF:
> > from
> > >FILE:/tmp/krb5cc_testuser with result: 0/Success
> > >[47700] 1530630765.611003: Read config in FILE:/tmp/krb5cc_testuser for
> > >krbtgt/MYREALM@MYREALM: fast_avail: yes
> > >[47700] 1530630765.611006: Using FAST due to armor ccache negotiation
> > result
> > >[47700] 1530630765.611016: Getting credentials admin@MYREALM ->
> > >krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
> > >[47700] 1530630765.611044: Retrieving admin@MYREALM ->
> > >krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result:
> > 0/Success
> > >[47700] 1530630765.611061: Armor ccache sesion key: aes256-cts/2559
> > >[47700] 1530630765.611089: Creating authenticator for admin@MYREALM ->
> > >krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/7F39, session key
> > >aes256-cts/2559
> > >[47700] 1530630765.611168: FAST armor key: aes256-cts/79AB
> > >[47700] 1530630765.611179: Setting initial creds service to
> > kadmin/changepw
> > >[47700] 1530630765.611184: FAST armor ccache: FILE:/tmp/krb5cc_testuser
> > >[47700] 1530630765.611208: Retrieving admin@MYREALM ->
> > >krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF:
> > from
> > >FILE:/tmp/krb5cc_testuser with result: 0/Success
> > >[47700] 1530630765.611212: Read config in FILE:/tmp/krb5cc_testuser for
> > >krbtgt/MYREALM@MYREALM: fast_avail: yes
> > >[47700] 1530630765.611213: Using FAST due to armor ccache negotiation
> > result
> > >[47700] 1530630765.611219: Getting credentials admin@MYREALM ->
> > >krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
> > >[47700] 1530630765.611240: Retrieving admin@MYREALM ->
> > >krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result:
> > 0/Success
> > >[47700] 1530630765.611245: Armor ccache sesion key: aes256-cts/2559
> > >[47700] 1530630765.611256: Creating authenticator for admin@MYREALM ->
> > >krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/2BFD, session key
> > >aes256-cts/2559
> > >[47700] 1530630765.611288: FAST armor key: aes256-cts/62C4
> > >[47700] 1530630765.611299: Encoding request body and padata into FAST
> > >request
> > >[47700] 1530630765.611333: Sending request (1019 bytes) to MYREALM
> > >[47700] 1530630765.611418: Resolving hostname ipamasterhostname
> > >[47700] 1530630765.611608: Initiating TCP connection to stream
> > >ipamasterIP:88
> > >[47700] 1530630765.611769: Sending TCP request to stream ipamasterIP:88
> > >[47700] 1530630765.675154: Received answer from stream ipamasterIP:88
> > >[47700] 1530630765.675208: Response was from master KDC
> > >[47700] 1530630765.675238: Received error from KDC: -1765328359/Additional
> > >pre-authentication required
> > >[47700] 1530630765.675249: Decoding FAST response
> > >[47700] 1530630765.675311: Processing preauth types: 136, 19, 138, 133,
> > 137
> > >[47700] 1530630765.675319: Received cookie: MIT
> > >Password for test_user@MYREALM:
> > Here you are asked for a password.
> >
> > >[47700] 1530630765.682884: Preauth module
> > >encrypted_challenge (138) (flags=1) returned: 0/Success
> > >[47700] 1530630765.682889: Produced preauth for next request: 133, 138
> > >[47700] 1530630765.682891: Encoding request body and padata into FAST
> > >request
> > >[47700] 1530630765.682951: Sending request (1118 bytes) to MYREALM
> > >[47700] 1530630765.682967: Resolving hostname ipamasterhostname
> > >[47700] 1530630765.683098: Initiating TCP connection to stream
> > >ipamasterIP:88
> > >[47700] 1530630765.683180: Sending TCP request to stream ipamasterIP:88
> > >[47700] 1530630765.756232: Received answer from stream ipamasterIP:88
> > >[47700] 1530630765.756302: Response was from master KDC
> > >[47700] 1530630765.756321: Received error from KDC:
> > >-1765328360/Preauthentication failed
> > >[47700] 1530630765.756325: Decoding FAST response
> > >[47700] 1530630765.756376: Preauth tryagain input types: 136, 19, 138,
> > 133,
> > >137
> > >kpasswd: Preauthentication failed getting initial ticket
> > And your password (what kpasswd uses as a password) is incorrect (to
> > what KDC considers you have as a password).
> >
> > >
> > >)
> > >###
> > >
> > >I don't understand yet why the commande kpasswd is failing ?
> > >
> > >My ticket admin is good.
> > >My ticket cache is used only by me.
> > >
> > >May you help me to understand what is going on please ?
> > Try first to get this working interactively.
> >
> > >Is there a way to use ipa python library to perform a kpasswd instead of
> > >popen of kpasswd command ?
> > >
> > >Best regards.
> > >
> > >Lune
> >
> > >_______________________________________________
> > >FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > >To unsubscribe send an email to
> > freeipa-users-leave(a)lists.fedorahosted.org
> > >Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > >List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > >List Archives:
> >
> https://lists.fedoraproject.org/archives/list/[e-mail]...
> >
> >
> > --
> > / Alexander Bokovoy
> > Sr. Principal Software Engineer
> > Security / Identity Management Engineering
> > Red Hat Limited, Finland
> > 
-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[lune voo]

I will try to reproduce the problem interactively in python.

Lune



Le mer. 4 juil. 2018 à 07:20, Alexander Bokovoy <abokovoy(a)redhat.com&gt; a
écrit :

>  On ke, 04 heinä 2018, lune voo wrote:
>  >Hello Alexander.
>  >
>  >Thanks for the answer.
>  >
>  >Otp stands for one time password.
>  >
>  >In fact in order to set a password for a user, I do first a ipa passwd
>  >using ipa python library.
>  So, your code is equivalent to
>
>  kinit admin
>  ipa passwd test-user
>  kpasswd test-user
>
>  ?
>
>  I.e. there is no 2FA involved and what you call 'otp' is only reflecting
>  the fact that any non-user-initiated password change forces that user to
>  change their password, so 'ipa passwd test-user' as admin means
>  'test-user' password has to be changed and becomes effectively a one
>  time password set by admin.
>
>  Is that a correct assessment?
>
>
>  >The otp is good normally.
>  Can you demonstrate things not working in a console, interactively?
>
>  >And the kpasswd password should be good also except if ipa kdc dont like
>  >some special characters ?
>  There is no limits on what Kerberos KDC considers a 'password' as that
>  could be a bunch of random bytes.
>
>  >
>  >Lune.
>  >
>  >
>  >Le mar. 3 juil. 2018 à 17:49, Alexander Bokovoy <abokovoy(a)redhat.com&gt; a
>  >écrit :
>  >
>  >> On ti, 03 heinä 2018, lune voo via FreeIPA-users wrote:
>  >> >Hello !
>  >> >
>  >> >I contact you because I encounter a problem when I use kpasswd using
>  >> python
>  >> >popen function.
>  >> >I use freeipa 3.0 and python 2.6.6.
>  >> >
>  >> >Here is what I do in python :
>  >> >
>  >> >input_process = otp + '\n' + password + '\n' + password
>  >> Here you provide otp (what is this? A 2FA token value?), password and
>  >> password.
>  >>
>  >> >cmd = 'kpasswd %s' % user_login
>  >> >cmd_and_args = shlex.split(cmd)
>  >> >p = Popen(cmd_and_args, stdout=PIPE, stdin=PIPE, stderr=STDOUT)
>  >> >(output, error) = p.communicate(input=input_process)
>  >> >
>  >> >
>  >> >Before doing that, I performed the following command in order to have
>  more
>  >> >logs :
>  >> >export KRB5_TRACE=/dev/stdout
>  >> >
>  >> >And here is what I see in the logs :
>  >> >###
>  >> >[47700] 1530630765.610794: Getting initial credentials for
>  >> test_user@MYREALM
>  >> >[47700] 1530630765.610945: FAST armor ccache: FILE:/tmp/krb5cc_testuser
>  >> >[47700] 1530630765.610998: Retrieving admin@MYREALM ->
>  >> >krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF:
>  >> from
>  >> >FILE:/tmp/krb5cc_testuser with result: 0/Success
>  >> >[47700] 1530630765.611003: Read config in FILE:/tmp/krb5cc_testuser for
>  >> >krbtgt/MYREALM@MYREALM: fast_avail: yes
>  >> >[47700] 1530630765.611006: Using FAST due to armor ccache negotiation
>  >> result
>  >> >[47700] 1530630765.611016: Getting credentials admin@MYREALM ->
>  >> >krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
>  >> >[47700] 1530630765.611044: Retrieving admin@MYREALM ->
>  >> >krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result:
>  >> 0/Success
>  >> >[47700] 1530630765.611061: Armor ccache sesion key: aes256-cts/2559
>  >> >[47700] 1530630765.611089: Creating authenticator for admin@MYREALM ->
>  >> >krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/7F39, session key
>  >> >aes256-cts/2559
>  >> >[47700] 1530630765.611168: FAST armor key: aes256-cts/79AB
>  >> >[47700] 1530630765.611179: Setting initial creds service to
>  >> kadmin/changepw
>  >> >[47700] 1530630765.611184: FAST armor ccache: FILE:/tmp/krb5cc_testuser
>  >> >[47700] 1530630765.611208: Retrieving admin@MYREALM ->
>  >> >krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF:
>  >> from
>  >> >FILE:/tmp/krb5cc_testuser with result: 0/Success
>  >> >[47700] 1530630765.611212: Read config in FILE:/tmp/krb5cc_testuser for
>  >> >krbtgt/MYREALM@MYREALM: fast_avail: yes
>  >> >[47700] 1530630765.611213: Using FAST due to armor ccache negotiation
>  >> result
>  >> >[47700] 1530630765.611219: Getting credentials admin@MYREALM ->
>  >> >krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
>  >> >[47700] 1530630765.611240: Retrieving admin@MYREALM ->
>  >> >krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result:
>  >> 0/Success
>  >> >[47700] 1530630765.611245: Armor ccache sesion key: aes256-cts/2559
>  >> >[47700] 1530630765.611256: Creating authenticator for admin@MYREALM ->
>  >> >krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/2BFD, session key
>  >> >aes256-cts/2559
>  >> >[47700] 1530630765.611288: FAST armor key: aes256-cts/62C4
>  >> >[47700] 1530630765.611299: Encoding request body and padata into FAST
>  >> >request
>  >> >[47700] 1530630765.611333: Sending request (1019 bytes) to MYREALM
>  >> >[47700] 1530630765.611418: Resolving hostname ipamasterhostname
>  >> >[47700] 1530630765.611608: Initiating TCP connection to stream
>  >> >ipamasterIP:88
>  >> >[47700] 1530630765.611769: Sending TCP request to stream ipamasterIP:88
>  >> >[47700] 1530630765.675154: Received answer from stream ipamasterIP:88
>  >> >[47700] 1530630765.675208: Response was from master KDC
>  >> >[47700] 1530630765.675238: Received error from KDC:
>  -1765328359/Additional
>  >> >pre-authentication required
>  >> >[47700] 1530630765.675249: Decoding FAST response
>  >> >[47700] 1530630765.675311: Processing preauth types: 136, 19, 138, 133,
>  >> 137
>  >> >[47700] 1530630765.675319: Received cookie: MIT
>  >> >Password for test_user@MYREALM:
>  >> Here you are asked for a password.
>  >>
>  >> >[47700] 1530630765.682884: Preauth module
>  >> >encrypted_challenge (138) (flags=1) returned: 0/Success
>  >> >[47700] 1530630765.682889: Produced preauth for next request: 133, 138
>  >> >[47700] 1530630765.682891: Encoding request body and padata into FAST
>  >> >request
>  >> >[47700] 1530630765.682951: Sending request (1118 bytes) to MYREALM
>  >> >[47700] 1530630765.682967: Resolving hostname ipamasterhostname
>  >> >[47700] 1530630765.683098: Initiating TCP connection to stream
>  >> >ipamasterIP:88
>  >> >[47700] 1530630765.683180: Sending TCP request to stream ipamasterIP:88
>  >> >[47700] 1530630765.756232: Received answer from stream ipamasterIP:88
>  >> >[47700] 1530630765.756302: Response was from master KDC
>  >> >[47700] 1530630765.756321: Received error from KDC:
>  >> >-1765328360/Preauthentication failed
>  >> >[47700] 1530630765.756325: Decoding FAST response
>  >> >[47700] 1530630765.756376: Preauth tryagain input types: 136, 19, 138,
>  >> 133,
>  >> >137
>  >> >kpasswd: Preauthentication failed getting initial ticket
>  >> And your password (what kpasswd uses as a password) is incorrect (to
>  >> what KDC considers you have as a password).
>  >>
>  >> >
>  >> >)
>  >> >###
>  >> >
>  >> >I don't understand yet why the commande kpasswd is failing ?
>  >> >
>  >> >My ticket admin is good.
>  >> >My ticket cache is used only by me.
>  >> >
>  >> >May you help me to understand what is going on please ?
>  >> Try first to get this working interactively.
>  >>
>  >> >Is there a way to use ipa python library to perform a kpasswd instead
>  of
>  >> >popen of kpasswd command ?
>  >> >
>  >> >Best regards.
>  >> >
>  >> >Lune
>  >>
>  >> >_______________________________________________
>  >> >FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  >> >To unsubscribe send an email to
>  >> freeipa-users-leave(a)lists.fedorahosted.org
>  >> >Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  >> >List Guidelines:
>  https://fedoraproject.org/wiki/Mailing_list_guidelines
>  >> >List Archives:
>  >>
>
> https://lists.fedoraproject.org/archives/list/[e-mail]...
>  >>
>  >>
>  >> --
>  >> / Alexander Bokovoy
>  >> Sr. Principal Software Engineer
>  >> Security / Identity Management Engineering
>  >> Red Hat Limited, Finland
>  >>
>
>  --
>  / Alexander Bokovoy
>  Sr. Principal Software Engineer
>  Security / Identity Management Engineering
>  Red Hat Limited, Finland
>

[Alexander Bokovoy]

On ke, 04 heinä 2018, lune voo via FreeIPA-users wrote:
> I will try to reproduce the problem interactively in python. 
I meant in shell, to rule out any issues outside your python code.

> Lune
>
>
>
> Le mer. 4 juil. 2018 à 07:20, Alexander Bokovoy <abokovoy(a)redhat.com&gt; a
> écrit :
>
> > On ke, 04 heinä 2018, lune voo wrote:
> > >Hello Alexander.
> > >
> > >Thanks for the answer.
> > >
> > >Otp stands for one time password.
> > >
> > >In fact in order to set a password for a user, I do first a ipa passwd
> > >using ipa python library.
> > So, your code is equivalent to
> >
> > kinit admin
> > ipa passwd test-user
> > kpasswd test-user
> >
> > ?
> >
> > I.e. there is no 2FA involved and what you call 'otp' is only reflecting
> > the fact that any non-user-initiated password change forces that user to
> > change their password, so 'ipa passwd test-user' as admin means
> > 'test-user' password has to be changed and becomes effectively a one
> > time password set by admin.
> >
> > Is that a correct assessment?
> >
> >
> > >The otp is good normally.
> > Can you demonstrate things not working in a console, interactively?
> >
> > >And the kpasswd password should be good also except if ipa kdc dont like
> > >some special characters ?
> > There is no limits on what Kerberos KDC considers a 'password' as that
> > could be a bunch of random bytes.
> >
> > >
> > >Lune.
> > >
> > >
> > >Le mar. 3 juil. 2018 à 17:49, Alexander Bokovoy <abokovoy(a)redhat.com&gt; a
> > >écrit :
> > >
> > >> On ti, 03 heinä 2018, lune voo via FreeIPA-users wrote:
> > >> >Hello !
> > >> >
> > >> >I contact you because I encounter a problem when I use kpasswd using
> > >> python
> > >> >popen function.
> > >> >I use freeipa 3.0 and python 2.6.6.
> > >> >
> > >> >Here is what I do in python :
> > >> >
> > >> >input_process = otp + '\n' + password + '\n' + password
> > >> Here you provide otp (what is this? A 2FA token value?), password and
> > >> password.
> > >>
> > >> >cmd = 'kpasswd %s' % user_login
> > >> >cmd_and_args = shlex.split(cmd)
> > >> >p = Popen(cmd_and_args, stdout=PIPE, stdin=PIPE, stderr=STDOUT)
> > >> >(output, error) = p.communicate(input=input_process)
> > >> >
> > >> >
> > >> >Before doing that, I performed the following command in order to have
> > more
> > >> >logs :
> > >> >export KRB5_TRACE=/dev/stdout
> > >> >
> > >> >And here is what I see in the logs :
> > >> >###
> > >> >[47700] 1530630765.610794: Getting initial credentials for
> > >> test_user@MYREALM
> > >> >[47700] 1530630765.610945: FAST armor ccache: FILE:/tmp/krb5cc_testuser
> > >> >[47700] 1530630765.610998: Retrieving admin@MYREALM ->
> > >> >krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF:
> > >> from
> > >> >FILE:/tmp/krb5cc_testuser with result: 0/Success
> > >> >[47700] 1530630765.611003: Read config in FILE:/tmp/krb5cc_testuser for
> > >> >krbtgt/MYREALM@MYREALM: fast_avail: yes
> > >> >[47700] 1530630765.611006: Using FAST due to armor ccache negotiation
> > >> result
> > >> >[47700] 1530630765.611016: Getting credentials admin@MYREALM ->
> > >> >krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
> > >> >[47700] 1530630765.611044: Retrieving admin@MYREALM ->
> > >> >krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result:
> > >> 0/Success
> > >> >[47700] 1530630765.611061: Armor ccache sesion key: aes256-cts/2559
> > >> >[47700] 1530630765.611089: Creating authenticator for admin@MYREALM
> ->
> > >> >krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/7F39, session key
> > >> >aes256-cts/2559
> > >> >[47700] 1530630765.611168: FAST armor key: aes256-cts/79AB
> > >> >[47700] 1530630765.611179: Setting initial creds service to
> > >> kadmin/changepw
> > >> >[47700] 1530630765.611184: FAST armor ccache: FILE:/tmp/krb5cc_testuser
> > >> >[47700] 1530630765.611208: Retrieving admin@MYREALM ->
> > >> >krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF:
> > >> from
> > >> >FILE:/tmp/krb5cc_testuser with result: 0/Success
> > >> >[47700] 1530630765.611212: Read config in FILE:/tmp/krb5cc_testuser for
> > >> >krbtgt/MYREALM@MYREALM: fast_avail: yes
> > >> >[47700] 1530630765.611213: Using FAST due to armor ccache negotiation
> > >> result
> > >> >[47700] 1530630765.611219: Getting credentials admin@MYREALM ->
> > >> >krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
> > >> >[47700] 1530630765.611240: Retrieving admin@MYREALM ->
> > >> >krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result:
> > >> 0/Success
> > >> >[47700] 1530630765.611245: Armor ccache sesion key: aes256-cts/2559
> > >> >[47700] 1530630765.611256: Creating authenticator for admin@MYREALM
> ->
> > >> >krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/2BFD, session key
> > >> >aes256-cts/2559
> > >> >[47700] 1530630765.611288: FAST armor key: aes256-cts/62C4
> > >> >[47700] 1530630765.611299: Encoding request body and padata into FAST
> > >> >request
> > >> >[47700] 1530630765.611333: Sending request (1019 bytes) to MYREALM
> > >> >[47700] 1530630765.611418: Resolving hostname ipamasterhostname
> > >> >[47700] 1530630765.611608: Initiating TCP connection to stream
> > >> >ipamasterIP:88
> > >> >[47700] 1530630765.611769: Sending TCP request to stream ipamasterIP:88
> > >> >[47700] 1530630765.675154: Received answer from stream ipamasterIP:88
> > >> >[47700] 1530630765.675208: Response was from master KDC
> > >> >[47700] 1530630765.675238: Received error from KDC:
> > -1765328359/Additional
> > >> >pre-authentication required
> > >> >[47700] 1530630765.675249: Decoding FAST response
> > >> >[47700] 1530630765.675311: Processing preauth types: 136, 19, 138, 133,
> > >> 137
> > >> >[47700] 1530630765.675319: Received cookie: MIT
> > >> >Password for test_user@MYREALM:
> > >> Here you are asked for a password.
> > >>
> > >> >[47700] 1530630765.682884: Preauth module
> > >> >encrypted_challenge (138) (flags=1) returned: 0/Success
> > >> >[47700] 1530630765.682889: Produced preauth for next request: 133, 138
> > >> >[47700] 1530630765.682891: Encoding request body and padata into FAST
> > >> >request
> > >> >[47700] 1530630765.682951: Sending request (1118 bytes) to MYREALM
> > >> >[47700] 1530630765.682967: Resolving hostname ipamasterhostname
> > >> >[47700] 1530630765.683098: Initiating TCP connection to stream
> > >> >ipamasterIP:88
> > >> >[47700] 1530630765.683180: Sending TCP request to stream ipamasterIP:88
> > >> >[47700] 1530630765.756232: Received answer from stream ipamasterIP:88
> > >> >[47700] 1530630765.756302: Response was from master KDC
> > >> >[47700] 1530630765.756321: Received error from KDC:
> > >> >-1765328360/Preauthentication failed
> > >> >[47700] 1530630765.756325: Decoding FAST response
> > >> >[47700] 1530630765.756376: Preauth tryagain input types: 136, 19, 138,
> > >> 133,
> > >> >137
> > >> >kpasswd: Preauthentication failed getting initial ticket
> > >> And your password (what kpasswd uses as a password) is incorrect (to
> > >> what KDC considers you have as a password).
> > >>
> > >> >
> > >> >)
> > >> >###
> > >> >
> > >> >I don't understand yet why the commande kpasswd is failing ?
> > >> >
> > >> >My ticket admin is good.
> > >> >My ticket cache is used only by me.
> > >> >
> > >> >May you help me to understand what is going on please ?
> > >> Try first to get this working interactively.
> > >>
> > >> >Is there a way to use ipa python library to perform a kpasswd instead
> > of
> > >> >popen of kpasswd command ?
> > >> >
> > >> >Best regards.
> > >> >
> > >> >Lune
> > >>
> > >> >_______________________________________________
> > >> >FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > >> >To unsubscribe send an email to
> > >> freeipa-users-leave(a)lists.fedorahosted.org
> > >> >Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > >> >List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > >> >List Archives:
> > >>
> >
> https://lists.fedoraproject.org/archives/list/[e-mail]...
> > >>
> > >>
> > >> --
> > >> / Alexander Bokovoy
> > >> Sr. Principal Software Engineer
> > >> Security / Identity Management Engineering
> > >> Red Hat Limited, Finland
> > >>
> >
> > --
> > / Alexander Bokovoy
> > Sr. Principal Software Engineer
> > Security / Identity Management Engineering
> > Red Hat Limited, Finland
> > 
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: ${hyperkitty_url} 

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[lune voo]

Hello Alexander.

I tried to reproduce the error with standard command ipa passwd and kpasswd
in a shell.
I was not able to reproduce the problem (even by using the same passwords).

I also performed another test in python.
I added a loop to retry the kpasswd if it fails with this kind of errors.
If the kpasswd fails with this error, I also added an ipa user-unlock to
prevent the user to be locked.
For the ipa user-unlock, I also uses the ipa python library.
It works at the fourth iteration, but the three first times, it fails with
the error I mentioned before.

Here is the logs I wrote about that :
(don't worry about the credentials, this is a test user that I removed just
after my command)
###
2018-07-03 17:12:36,235;INFO;BEGIN
2018-07-03 17:12:36,235;INFO;Creating user login test_user
2018-07-03 17:12:36,235;INFO;Creating IPA account...
2018-07-03 17:12:45,127;INFO;Generating and setting password for the login
test_user...
2018-07-03 17:12:45,276;INFO;ipa passwd for user test_user has ended with
the following summary : Changed password for "test_user@MYREALM"
2018-07-03 17:12:45,280;INFO;login = test_user, one_time_password =
Kk)4YIRq, password = fJ6f4%(5
2018-07-03 17:12:45,503;INFO;1st kpasswd try
2018-07-03 17:12:45,503;INFO;kpasswd stdout : [47695] 1530630765.283620:
Getting initial credentials for test_user@MYREALM
[47695] 1530630765.283766: FAST armor ccache: FILE:/tmp/krb5cc_testuser
[47695] 1530630765.283812: Retrieving admin@MYREALM ->
krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF: from
FILE:/tmp/krb5cc_testuser with result: 0/Success
[47695] 1530630765.283818: Read config in FILE:/tmp/krb5cc_testuser for
krbtgt/MYREALM@MYREALM: fast_avail: yes
[47695] 1530630765.283821: Using FAST due to armor ccache negotiation result
[47695] 1530630765.283831: Getting credentials admin@MYREALM ->
krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
[47695] 1530630765.283862: Retrieving admin@MYREALM ->
krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result: 0/Success
[47695] 1530630765.283882: Armor ccache sesion key: aes256-cts/2559
[47695] 1530630765.283914: Creating authenticator for admin@MYREALM ->
krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/2FB3, session key
aes256-cts/2559
[47695] 1530630765.284000: FAST armor key: aes256-cts/552F
[47695] 1530630765.284013: Setting initial creds service to kadmin/changepw
[47695] 1530630765.284018: FAST armor ccache: FILE:/tmp/krb5cc_testuser
[47695] 1530630765.284043: Retrieving admin@MYREALM ->
krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF: from
FILE:/tmp/krb5cc_testuser with result: 0/Success
[47695] 1530630765.284046: Read config in FILE:/tmp/krb5cc_testuser for
krbtgt/MYREALM@MYREALM: fast_avail: yes
[47695] 1530630765.284048: Using FAST due to armor ccache negotiation result
[47695] 1530630765.284055: Getting credentials admin@MYREALM ->
krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
[47695] 1530630765.284076: Retrieving admin@MYREALM ->
krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result: 0/Success
[47695] 1530630765.284082: Armor ccache sesion key: aes256-cts/2559
[47695] 1530630765.284094: Creating authenticator for admin@MYREALM ->
krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/7296, session key
aes256-cts/2559
[47695] 1530630765.284126: FAST armor key: aes256-cts/1070
[47695] 1530630765.284139: Encoding request body and padata into FAST
request
[47695] 1530630765.284176: Sending request (1019 bytes) to MYREALM
[47695] 1530630765.284263: Resolving hostname ipamasterhostname
[47695] 1530630765.284544: Initiating TCP connection to stream
ipamasterIP:88
[47695] 1530630765.284711: Sending TCP request to stream ipamasterIP:88
[47695] 1530630765.468306: Received answer from stream ipamasterIP:88
[47695] 1530630765.468362: Response was from master KDC
[47695] 1530630765.468390: Received error from KDC: -1765328359/Additional
pre-authentication required
[47695] 1530630765.468402: Decoding FAST response
[47695] 1530630765.468470: Processing preauth types: 136, 19, 138, 133, 137
[47695] 1530630765.468478: Received cookie: MIT
Password for test_user@MYREALM: [47695] 1530630765.476399: Preauth module
encrypted_challenge (138) (flags=1) returned: 0/Success
[47695] 1530630765.476404: Produced preauth for next request: 133, 138
[47695] 1530630765.476407: Encoding request body and padata into FAST
request
[47695] 1530630765.476470: Sending request (1118 bytes) to MYREALM
[47695] 1530630765.476489: Resolving hostname ipamasterhostname
[47695] 1530630765.476657: Initiating TCP connection to stream
ipamasterIP:88
[47695] 1530630765.476763: Sending TCP request to stream ipamasterIP:88
[47695] 1530630765.503131: Received answer from stream ipamasterIP:88
[47695] 1530630765.503185: Response was from master KDC
[47695] 1530630765.503212: Received error from KDC:
-1765328360/Preauthentication failed
[47695] 1530630765.503216: Decoding FAST response
[47695] 1530630765.503265: Preauth tryagain input types: 136, 19, 138, 133,
137
kpasswd: Preauthentication failed getting initial ticket

)
2018-07-03 17:12:45,504;INFO;sortie err cmd : None)
2018-07-03 17:12:45,607;INFO;Action 'user-unlock' for user test_user ended
with the following summary : Unlocked account " test_user"
2018-07-03 17:12:45,608;INFO;login = test_user, one_time_password =
Kk)4YIRq, password = fJ6f4%(5
2018-07-03 17:12:45,503;INFO;2nd kpasswd try
2018-07-03 17:12:45,756;INFO;kpasswd stdout : [47700] 1530630765.610794:
Getting initial credentials for test_user@MYREALM
[47700] 1530630765.610945: FAST armor ccache: FILE:/tmp/krb5cc_testuser
[47700] 1530630765.610998: Retrieving admin@MYREALM ->
krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF: from
FILE:/tmp/krb5cc_testuser with result: 0/Success
[47700] 1530630765.611003: Read config in FILE:/tmp/krb5cc_testuser for
krbtgt/MYREALM@MYREALM: fast_avail: yes
[47700] 1530630765.611006: Using FAST due to armor ccache negotiation result
[47700] 1530630765.611016: Getting credentials admin@MYREALM ->
krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
[47700] 1530630765.611044: Retrieving admin@MYREALM ->
krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result: 0/Success
[47700] 1530630765.611061: Armor ccache sesion key: aes256-cts/2559
[47700] 1530630765.611089: Creating authenticator for admin@MYREALM ->
krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/7F39, session key
aes256-cts/2559
[47700] 1530630765.611168: FAST armor key: aes256-cts/79AB
[47700] 1530630765.611179: Setting initial creds service to kadmin/changepw
[47700] 1530630765.611184: FAST armor ccache: FILE:/tmp/krb5cc_testuser
[47700] 1530630765.611208: Retrieving admin@MYREALM ->
krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF: from
FILE:/tmp/krb5cc_testuser with result: 0/Success
[47700] 1530630765.611212: Read config in FILE:/tmp/krb5cc_testuser for
krbtgt/MYREALM@MYREALM: fast_avail: yes
[47700] 1530630765.611213: Using FAST due to armor ccache negotiation result
[47700] 1530630765.611219: Getting credentials admin@MYREALM ->
krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
[47700] 1530630765.611240: Retrieving admin@MYREALM ->
krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result: 0/Success
[47700] 1530630765.611245: Armor ccache sesion key: aes256-cts/2559
[47700] 1530630765.611256: Creating authenticator for admin@MYREALM ->
krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/2BFD, session key
aes256-cts/2559
[47700] 1530630765.611288: FAST armor key: aes256-cts/62C4
[47700] 1530630765.611299: Encoding request body and padata into FAST
request
[47700] 1530630765.611333: Sending request (1019 bytes) to MYREALM
[47700] 1530630765.611418: Resolving hostname ipamasterhostname
[47700] 1530630765.611608: Initiating TCP connection to stream
ipamasterIP:88
[47700] 1530630765.611769: Sending TCP request to stream ipamasterIP:88
[47700] 1530630765.675154: Received answer from stream ipamasterIP:88
[47700] 1530630765.675208: Response was from master KDC
[47700] 1530630765.675238: Received error from KDC: -1765328359/Additional
pre-authentication required
[47700] 1530630765.675249: Decoding FAST response
[47700] 1530630765.675311: Processing preauth types: 136, 19, 138, 133, 137
[47700] 1530630765.675319: Received cookie: MIT
Password for test_user@MYREALM: [47700] 1530630765.682884: Preauth module
encrypted_challenge (138) (flags=1) returned: 0/Success
[47700] 1530630765.682889: Produced preauth for next request: 133, 138
[47700] 1530630765.682891: Encoding request body and padata into FAST
request
[47700] 1530630765.682951: Sending request (1118 bytes) to MYREALM
[47700] 1530630765.682967: Resolving hostname ipamasterhostname
[47700] 1530630765.683098: Initiating TCP connection to stream
ipamasterIP:88
[47700] 1530630765.683180: Sending TCP request to stream ipamasterIP:88
[47700] 1530630765.756232: Received answer from stream ipamasterIP:88
[47700] 1530630765.756302: Response was from master KDC
[47700] 1530630765.756321: Received error from KDC:
-1765328360/Preauthentication failed
[47700] 1530630765.756325: Decoding FAST response
[47700] 1530630765.756376: Preauth tryagain input types: 136, 19, 138, 133,
137
kpasswd: Preauthentication failed getting initial ticket

)
2018-07-03 17:12:45,757;INFO;sortie err cmd : None)
2018-07-03 17:12:45,863;INFO;login = test_user, one_time_password =
Kk)4YIRq, password = fJ6f4%(5
2018-07-03 17:12:45,503;INFO;3rd kpasswd try
2018-07-03 17:12:45,963;INFO;kpasswd stdout : [47711] 1530630765.866915:
Getting initial credentials for test_user@MYREALM
[47711] 1530630765.867035: FAST armor ccache: FILE:/tmp/krb5cc_testuser
[47711] 1530630765.867075: Retrieving admin@MYREALM ->
krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF: from
FILE:/tmp/krb5cc_testuser with result: 0/Success
[47711] 1530630765.867081: Read config in FILE:/tmp/krb5cc_testuser for
krbtgt/MYREALM@MYREALM: fast_avail: yes
[47711] 1530630765.867083: Using FAST due to armor ccache negotiation result
[47711] 1530630765.867093: Getting credentials admin@MYREALM ->
krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
[47711] 1530630765.867123: Retrieving admin@MYREALM ->
krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result: 0/Success
[47711] 1530630765.867144: Armor ccache sesion key: aes256-cts/2559
[47711] 1530630765.867171: Creating authenticator for admin@MYREALM ->
krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/AD04, session key
aes256-cts/2559
[47711] 1530630765.867244: FAST armor key: aes256-cts/D781
[47711] 1530630765.867255: Setting initial creds service to kadmin/changepw
[47711] 1530630765.867260: FAST armor ccache: FILE:/tmp/krb5cc_testuser
[47711] 1530630765.867286: Retrieving admin@MYREALM ->
krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF: from
FILE:/tmp/krb5cc_testuser with result: 0/Success
[47711] 1530630765.867289: Read config in FILE:/tmp/krb5cc_testuser for
krbtgt/MYREALM@MYREALM: fast_avail: yes
[47711] 1530630765.867291: Using FAST due to armor ccache negotiation result
[47711] 1530630765.867298: Getting credentials admin@MYREALM ->
krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
[47711] 1530630765.867320: Retrieving admin@MYREALM ->
krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result: 0/Success
[47711] 1530630765.867326: Armor ccache sesion key: aes256-cts/2559
[47711] 1530630765.867337: Creating authenticator for admin@MYREALM ->
krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/5503, session key
aes256-cts/2559
[47711] 1530630765.867368: FAST armor key: aes256-cts/6759
[47711] 1530630765.867379: Encoding request body and padata into FAST
request
[47711] 1530630765.867413: Sending request (1019 bytes) to MYREALM
[47711] 1530630765.867490: Resolving hostname ipamasterhostname
[47711] 1530630765.867714: Initiating TCP connection to stream
ipamasterIP:88
[47711] 1530630765.867854: Sending TCP request to stream ipamasterIP:88
[47711] 1530630765.895839: Received answer from stream ipamasterIP:88
[47711] 1530630765.895877: Response was from master KDC
[47711] 1530630765.895920: Received error from KDC: -1765328359/Additional
pre-authentication required
[47711] 1530630765.895944: Decoding FAST response
[47711] 1530630765.896007: Processing preauth types: 136, 19, 138, 133, 137
[47711] 1530630765.896016: Received cookie: MIT
Password for test_user@MYREALM: [47711] 1530630765.903391: Preauth module
encrypted_challenge (138) (flags=1) returned: 0/Success
[47711] 1530630765.903395: Produced preauth for next request: 133, 138
[47711] 1530630765.903397: Encoding request body and padata into FAST
request
[47711] 1530630765.903444: Sending request (1118 bytes) to MYREALM
[47711] 1530630765.903458: Resolving hostname ipamasterhostname
[47711] 1530630765.903578: Initiating TCP connection to stream
ipamasterIP:88
[47711] 1530630765.903702: Sending TCP request to stream ipamasterIP:88
[47711] 1530630765.963169: Received answer from stream ipamasterIP:88
[47711] 1530630765.963218: Response was from master KDC
[47711] 1530630765.963230: Received error from KDC:
-1765328360/Preauthentication failed
[47711] 1530630765.963234: Decoding FAST response
[47711] 1530630765.963268: Preauth tryagain input types: 136, 19, 138, 133,
137
kpasswd: Preauthentication failed getting initial ticket

)
2018-07-03 17:12:45,964;INFO;sortie err cmd : None)
2018-07-03 17:12:46,072;INFO;Action 'user-unlock' for user test_user ended
with the following summary : Unlocked account " test_user"
2018-07-03 17:12:46,072;INFO;login = test_user, one_time_password =
Kk)4YIRq, password = fJ6f4%(5
2018-07-03 17:12:45,503;INFO;4th kpasswd try
2018-07-03 17:12:46,294;INFO;kpasswd stdout : [47717] 1530630766.75265:
Getting initial credentials for test_user@MYREALM
[47717] 1530630766.75375: FAST armor ccache: FILE:/tmp/krb5cc_testuser
[47717] 1530630766.75413: Retrieving admin@MYREALM ->
krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF: from
FILE:/tmp/krb5cc_testuser with result: 0/Success
[47717] 1530630766.75418: Read config in FILE:/tmp/krb5cc_testuser for
krbtgt/MYREALM@MYREALM: fast_avail: yes
[47717] 1530630766.75420: Using FAST due to armor ccache negotiation result
[47717] 1530630766.75430: Getting credentials admin@MYREALM ->
krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
[47717] 1530630766.75456: Retrieving admin@MYREALM -> krbtgt/MYREALM@MYREALM
from FILE:/tmp/krb5cc_testuser with result: 0/Success
[47717] 1530630766.75471: Armor ccache sesion key: aes256-cts/2559
[47717] 1530630766.75497: Creating authenticator for admin@MYREALM ->
krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/0E9B, session key
aes256-cts/2559
[47717] 1530630766.75567: FAST armor key: aes256-cts/99B6
[47717] 1530630766.75578: Setting initial creds service to kadmin/changepw
[47717] 1530630766.75582: FAST armor ccache: FILE:/tmp/krb5cc_testuser
[47717] 1530630766.75606: Retrieving admin@MYREALM ->
krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF: from
FILE:/tmp/krb5cc_testuser with result: 0/Success
[47717] 1530630766.75610: Read config in FILE:/tmp/krb5cc_testuser for
krbtgt/MYREALM@MYREALM: fast_avail: yes
[47717] 1530630766.75611: Using FAST due to armor ccache negotiation result
[47717] 1530630766.75617: Getting credentials admin@MYREALM ->
krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
[47717] 1530630766.75641: Retrieving admin@MYREALM -> krbtgt/MYREALM@MYREALM
from FILE:/tmp/krb5cc_testuser with result: 0/Success
[47717] 1530630766.75647: Armor ccache sesion key: aes256-cts/2559
[47717] 1530630766.75672: Creating authenticator for admin@MYREALM ->
krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/CC46, session key
aes256-cts/2559
[47717] 1530630766.75706: FAST armor key: aes256-cts/CC9E
[47717] 1530630766.75717: Encoding request body and padata into FAST request
[47717] 1530630766.75753: Sending request (1019 bytes) to MYREALM
[47717] 1530630766.75829: Resolving hostname ipamasterhostname
[47717] 1530630766.75968: Initiating TCP connection to stream ipamasterIP:88
[47717] 1530630766.76081: Sending TCP request to stream ipamasterIP:88
[47717] 1530630766.131982: Received answer from stream ipamasterIP:88
[47717] 1530630766.132069: Response was from master KDC
[47717] 1530630766.132108: Received error from KDC: -1765328359/Additional
pre-authentication required
[47717] 1530630766.132120: Decoding FAST response
[47717] 1530630766.132198: Processing preauth types: 136, 19, 138, 133, 137
[47717] 1530630766.132209: Selected etype info: etype aes256-cts, salt
")(DFnJ,r6Rx!Y#'D", params ""
[47717] 1530630766.132212: Received cookie: MIT
Password for test_user@MYREALM: [47717] 1530630766.139327: Preauth module
encrypted_challenge (138) (flags=1) returned: 0/Success
[47717] 1530630766.139330: Produced preauth for next request: 133, 138
[47717] 1530630766.139333: Encoding request body and padata into FAST
request
[47717] 1530630766.139384: Sending request (1118 bytes) to MYREALM
[47717] 1530630766.139396: Resolving hostname ipamasterhostname
[47717] 1530630766.139522: Initiating TCP connection to stream
ipamasterIP:88
[47717] 1530630766.139645: Sending TCP request to stream ipamasterIP:88
[47717] 1530630766.211079: Received answer from stream ipamasterIP:88
[47717] 1530630766.211157: Response was from master KDC
[47717] 1530630766.211190: Decoding FAST response
[47717] 1530630766.211299: Processing preauth types: 19, 138
[47717] 1530630766.211310: Selected etype info: etype aes256-cts, salt
")(DFnJ,r6Rx!Y#'D", params ""
[47717] 1530630766.211380: Preauth module encrypted_challenge (138)
(flags=1) returned: 0/Success
[47717] 1530630766.211396: Produced preauth for next request: (empty)
[47717] 1530630766.211400: AS key determined by preauth: aes256-cts/23C9
[47717] 1530630766.211412: FAST reply key: aes256-cts/9E0D
[47717] 1530630766.211432: Decrypted AS reply; session key is:
aes256-cts/2BAA
[47717] 1530630766.211443: FAST negotiation: available

Enter new password:
Enter it again: [47717] 1530630766.211515: Creating authenticator for
test_user@MYREALM -> kadmin/changepw@MYREALM, seqnum 0, subkey
aes256-cts/BC7C, session key aes256-cts/2BAA
[47717] 1530630766.211555: Resolving hostname ipamasterhostname
[47717] 1530630766.211748: Sending initial UDP request to dgram
ipamasterIP:464
[47717] 1530630766.293996: Received answer from dgram ipamasterIP:464
[47717] 1530630766.294064: Read AP-REP, time 1530630766.211518, subkey
aes256-cts/BC7C, seqnum 202122897

Password changed.
)
2018-07-03 17:12:46,294;INFO;sortie err cmd : None)
2018-07-03 17:12:46,294;INFO;END
###

What do you think about this please ?

BR.

Lune

2018-07-04 7:55 GMT+02:00 Alexander Bokovoy <abokovoy(a)redhat.com&gt;:

>  On ke, 04 heinä 2018, lune voo via FreeIPA-users wrote:
>
> > I will try to reproduce the problem interactively in python.
> >
>
>  I meant in shell, to rule out any issues outside your python code.
>
>
>
> > Lune
> >
> >
> >
> > Le mer. 4 juil. 2018 à 07:20, Alexander Bokovoy <abokovoy(a)redhat.com&gt; a
> > écrit :
> >
> > On ke, 04 heinä 2018, lune voo wrote:
> >> >Hello Alexander.
> >> >
> >> >Thanks for the answer.
> >> >
> >> >Otp stands for one time password.
> >> >
> >> >In fact in order to set a password for a user, I do first a ipa passwd
> >> >using ipa python library.
> >> So, your code is equivalent to
> >>
> >> kinit admin
> >> ipa passwd test-user
> >> kpasswd test-user
> >>
> >> ?
> >>
> >> I.e. there is no 2FA involved and what you call 'otp' is only reflecting
> >> the fact that any non-user-initiated password change forces that user to
> >> change their password, so 'ipa passwd test-user' as admin means
> >> 'test-user' password has to be changed and becomes effectively a one
> >> time password set by admin.
> >>
> >> Is that a correct assessment?
> >>
> >>
> >> >The otp is good normally.
> >> Can you demonstrate things not working in a console, interactively?
> >>
> >> >And the kpasswd password should be good also except if ipa kdc dont like
> >> >some special characters ?
> >> There is no limits on what Kerberos KDC considers a 'password' as that
> >> could be a bunch of random bytes.
> >>
> >> >
> >> >Lune.
> >> >
> >> >
> >> >Le mar. 3 juil. 2018 à 17:49, Alexander Bokovoy <abokovoy(a)redhat.com&gt;
> a
> >> >écrit :
> >> >
> >> >> On ti, 03 heinä 2018, lune voo via FreeIPA-users wrote:
> >> >> >Hello !
> >> >> >
> >> >> >I contact you because I encounter a problem when I use kpasswd
> using
> >> >> python
> >> >> >popen function.
> >> >> >I use freeipa 3.0 and python 2.6.6.
> >> >> >
> >> >> >Here is what I do in python :
> >> >> >
> >> >> >input_process = otp + '\n' + password + '\n' +
> password
> >> >> Here you provide otp (what is this? A 2FA token value?), password and
> >> >> password.
> >> >>
> >> >> >cmd = 'kpasswd %s' % user_login
> >> >> >cmd_and_args = shlex.split(cmd)
> >> >> >p = Popen(cmd_and_args, stdout=PIPE, stdin=PIPE, stderr=STDOUT)
> >> >> >(output, error) = p.communicate(input=input_process)
> >> >> >
> >> >> >
> >> >> >Before doing that, I performed the following command in order to
> have
> >> more
> >> >> >logs :
> >> >> >export KRB5_TRACE=/dev/stdout
> >> >> >
> >> >> >And here is what I see in the logs :
> >> >> >###
> >> >> >[47700] 1530630765.610794: Getting initial credentials for
> >> >> test_user@MYREALM
> >> >> >[47700] 1530630765.610945: FAST armor ccache:
> >> FILE:/tmp/krb5cc_testuser
> >> >> >[47700] 1530630765.610998: Retrieving admin@MYREALM ->
> >> >> >krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@
> >> X-CACHECONF:
> >> >> from
> >> >> >FILE:/tmp/krb5cc_testuser with result: 0/Success
> >> >> >[47700] 1530630765.611003: Read config in FILE:/tmp/krb5cc_testuser
> >> for
> >> >> >krbtgt/MYREALM@MYREALM: fast_avail: yes
> >> >> >[47700] 1530630765.611006: Using FAST due to armor ccache
> negotiation
> >> >> result
> >> >> >[47700] 1530630765.611016: Getting credentials admin@MYREALM ->
> >> >> >krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
> >> >> >[47700] 1530630765.611044: Retrieving admin@MYREALM ->
> >> >> >krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result:
> >> >> 0/Success
> >> >> >[47700] 1530630765.611061: Armor ccache sesion key: aes256-cts/2559
> >> >> >[47700] 1530630765.611089: Creating authenticator for admin@MYREALM
> >> ->
> >> >> >krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/7F39, session
> >> key
> >> >> >aes256-cts/2559
> >> >> >[47700] 1530630765.611168: FAST armor key: aes256-cts/79AB
> >> >> >[47700] 1530630765.611179: Setting initial creds service to
> >> >> kadmin/changepw
> >> >> >[47700] 1530630765.611184: FAST armor ccache:
> >> FILE:/tmp/krb5cc_testuser
> >> >> >[47700] 1530630765.611208: Retrieving admin@MYREALM ->
> >> >> >krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@
> >> X-CACHECONF:
> >> >> from
> >> >> >FILE:/tmp/krb5cc_testuser with result: 0/Success
> >> >> >[47700] 1530630765.611212: Read config in FILE:/tmp/krb5cc_testuser
> >> for
> >> >> >krbtgt/MYREALM@MYREALM: fast_avail: yes
> >> >> >[47700] 1530630765.611213: Using FAST due to armor ccache
> negotiation
> >> >> result
> >> >> >[47700] 1530630765.611219: Getting credentials admin@MYREALM ->
> >> >> >krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
> >> >> >[47700] 1530630765.611240: Retrieving admin@MYREALM ->
> >> >> >krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result:
> >> >> 0/Success
> >> >> >[47700] 1530630765.611245: Armor ccache sesion key: aes256-cts/2559
> >> >> >[47700] 1530630765.611256: Creating authenticator for admin@MYREALM
> >> ->
> >> >> >krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/2BFD, session
> >> key
> >> >> >aes256-cts/2559
> >> >> >[47700] 1530630765.611288: FAST armor key: aes256-cts/62C4
> >> >> >[47700] 1530630765.611299: Encoding request body and padata into
> FAST
> >> >> >request
> >> >> >[47700] 1530630765.611333: Sending request (1019 bytes) to MYREALM
> >> >> >[47700] 1530630765.611418: Resolving hostname ipamasterhostname
> >> >> >[47700] 1530630765.611608: Initiating TCP connection to stream
> >> >> >ipamasterIP:88
> >> >> >[47700] 1530630765.611769: Sending TCP request to stream
> >> ipamasterIP:88
> >> >> >[47700] 1530630765.675154: Received answer from stream
> ipamasterIP:88
> >> >> >[47700] 1530630765.675208: Response was from master KDC
> >> >> >[47700] 1530630765.675238: Received error from KDC:
> >> -1765328359/Additional
> >> >> >pre-authentication required
> >> >> >[47700] 1530630765.675249: Decoding FAST response
> >> >> >[47700] 1530630765.675311: Processing preauth types: 136, 19, 138,
> >> 133,
> >> >> 137
> >> >> >[47700] 1530630765.675319: Received cookie: MIT
> >> >> >Password for test_user@MYREALM:
> >> >> Here you are asked for a password.
> >> >>
> >> >> >[47700] 1530630765.682884: Preauth module
> >> >> >encrypted_challenge (138) (flags=1) returned: 0/Success
> >> >> >[47700] 1530630765.682889: Produced preauth for next request: 133,
> >> 138
> >> >> >[47700] 1530630765.682891: Encoding request body and padata into
> FAST
> >> >> >request
> >> >> >[47700] 1530630765.682951: Sending request (1118 bytes) to MYREALM
> >> >> >[47700] 1530630765.682967: Resolving hostname ipamasterhostname
> >> >> >[47700] 1530630765.683098: Initiating TCP connection to stream
> >> >> >ipamasterIP:88
> >> >> >[47700] 1530630765.683180: Sending TCP request to stream
> >> ipamasterIP:88
> >> >> >[47700] 1530630765.756232: Received answer from stream
> ipamasterIP:88
> >> >> >[47700] 1530630765.756302: Response was from master KDC
> >> >> >[47700] 1530630765.756321: Received error from KDC:
> >> >> >-1765328360/Preauthentication failed
> >> >> >[47700] 1530630765.756325: Decoding FAST response
> >> >> >[47700] 1530630765.756376: Preauth tryagain input types: 136, 19,
> >> 138,
> >> >> 133,
> >> >> >137
> >> >> >kpasswd: Preauthentication failed getting initial ticket
> >> >> And your password (what kpasswd uses as a password) is incorrect (to
> >> >> what KDC considers you have as a password).
> >> >>
> >> >> >
> >> >> >)
> >> >> >###
> >> >> >
> >> >> >I don't understand yet why the commande kpasswd is failing ?
> >> >> >
> >> >> >My ticket admin is good.
> >> >> >My ticket cache is used only by me.
> >> >> >
> >> >> >May you help me to understand what is going on please ?
> >> >> Try first to get this working interactively.
> >> >>
> >> >> >Is there a way to use ipa python library to perform a kpasswd
> instead
> >> of
> >> >> >popen of kpasswd command ?
> >> >> >
> >> >> >Best regards.
> >> >> >
> >> >> >Lune
> >> >>
> >> >> >_______________________________________________
> >> >> >FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> >> >> >To unsubscribe send an email to
> >> >> freeipa-users-leave(a)lists.fedorahosted.org
> >> >> >Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> >> >> >List Guidelines:
> >> https://fedoraproject.org/wiki/Mailing_list_guidelines
> >> >> >List Archives:
> >> >>
> >> https://lists.fedoraproject.org/archives/list/freeipa-users@
> >> lists.fedorahosted.org/message/3RC6MOLZNN2QIOXPZ6SMHPT53KDXEGAO/
> >> >>
> >> >>
> >> >> --
> >> >> / Alexander Bokovoy
> >> >> Sr. Principal Software Engineer
> >> >> Security / Identity Management Engineering
> >> >> Red Hat Limited, Finland
> >> >>
> >>
> >> --
> >> / Alexander Bokovoy
> >> Sr. Principal Software Engineer
> >> Security / Identity Management Engineering
> >> Red Hat Limited, Finland
> >>
> >>
>  _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to freeipa-users-leave(a)lists.fedo
> > rahosted.org
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: ${hyperkitty_url}
> >
>
>
>  --
>  / Alexander Bokovoy
>  Sr. Principal Software Engineer
>  Security / Identity Management Engineering
>  Red Hat Limited, Finland
>

[Alexander Bokovoy]

On ke, 04 heinä 2018, lune voo via FreeIPA-users wrote:
> Hello Alexander.
>
> I tried to reproduce the error with standard command ipa passwd and kpasswd
> in a shell.
> I was not able to reproduce the problem (even by using the same passwords).
>
> I also performed another test in python.
> I added a loop to retry the kpasswd if it fails with this kind of errors.
> If the kpasswd fails with this error, I also added an ipa user-unlock to
> prevent the user to be locked.
> For the ipa user-unlock, I also uses the ipa python library.
> It works at the fourth iteration, but the three first times, it fails with
> the error I mentioned before.
>
> Here is the logs I wrote about that :
> (don't worry about the credentials, this is a test user that I removed just
> after my command)
> ###
> 2018-07-03 17:12:36,235;INFO;BEGIN
> 2018-07-03 17:12:36,235;INFO;Creating user login test_user
> 2018-07-03 17:12:36,235;INFO;Creating IPA account...
> 2018-07-03 17:12:45,127;INFO;Generating and setting password for the login
> test_user...
> 2018-07-03 17:12:45,276;INFO;ipa passwd for user test_user has ended with
> the following summary : Changed password for "test_user@MYREALM"
> 2018-07-03 17:12:45,280;INFO;login = test_user, one_time_password =
> Kk)4YIRq, password = fJ6f4%(5
> 2018-07-03 17:12:45,503;INFO;1st kpasswd try
> 2018-07-03 17:12:45,503;INFO;kpasswd stdout : [47695] 1530630765.283620:
> Getting initial credentials for test_user@MYREALM
> [47695] 1530630765.283766: FAST armor ccache: FILE:/tmp/krb5cc_testuser
> [47695] 1530630765.283812: Retrieving admin@MYREALM ->
> krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF: from
> FILE:/tmp/krb5cc_testuser with result: 0/Success
> [47695] 1530630765.283818: Read config in FILE:/tmp/krb5cc_testuser for
> krbtgt/MYREALM@MYREALM: fast_avail: yes
> [47695] 1530630765.283821: Using FAST due to armor ccache negotiation result
> [47695] 1530630765.283831: Getting credentials admin@MYREALM ->
> krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
> [47695] 1530630765.283862: Retrieving admin@MYREALM ->
> krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result: 0/Success
> [47695] 1530630765.283882: Armor ccache sesion key: aes256-cts/2559
> [47695] 1530630765.283914: Creating authenticator for admin@MYREALM ->
> krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/2FB3, session key
> aes256-cts/2559
> [47695] 1530630765.284000: FAST armor key: aes256-cts/552F
> [47695] 1530630765.284013: Setting initial creds service to kadmin/changepw
> [47695] 1530630765.284018: FAST armor ccache: FILE:/tmp/krb5cc_testuser
> [47695] 1530630765.284043: Retrieving admin@MYREALM ->
> krb5_ccache_conf_data/fast_avail/krbtgt\/MYREALM\@MYREALM@X-CACHECONF: from
> FILE:/tmp/krb5cc_testuser with result: 0/Success
> [47695] 1530630765.284046: Read config in FILE:/tmp/krb5cc_testuser for
> krbtgt/MYREALM@MYREALM: fast_avail: yes
> [47695] 1530630765.284048: Using FAST due to armor ccache negotiation result
> [47695] 1530630765.284055: Getting credentials admin@MYREALM ->
> krbtgt/MYREALM@MYREALM using ccache FILE:/tmp/krb5cc_testuser
> [47695] 1530630765.284076: Retrieving admin@MYREALM ->
> krbtgt/MYREALM@MYREALM from FILE:/tmp/krb5cc_testuser with result: 0/Success
> [47695] 1530630765.284082: Armor ccache sesion key: aes256-cts/2559
> [47695] 1530630765.284094: Creating authenticator for admin@MYREALM ->
> krbtgt/MYREALM@MYREALM, seqnum 0, subkey aes256-cts/7296, session key
> aes256-cts/2559
> [47695] 1530630765.284126: FAST armor key: aes256-cts/1070
> [47695] 1530630765.284139: Encoding request body and padata into FAST
> request
> [47695] 1530630765.284176: Sending request (1019 bytes) to MYREALM
> [47695] 1530630765.284263: Resolving hostname ipamasterhostname
> [47695] 1530630765.284544: Initiating TCP connection to stream
> ipamasterIP:88 
How is this client finding a KDC? Is it using resolving via DNS SRV
records? Or is it forcibly configured to only talk to a single master?

If you have multiple masters and you are talking to a different master
after a password change done on some master, chances are that the other
master doesn't yet have the change propagated.

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland