kinit: Password incorrect while getting initial credentials

[nandha kumar]

Hi Team,

I am running redhat 7.5 with freeipa 4.5 . I have established AD one way sync using password.
I am able to ssh the ipa client and ipa server with windows administrator account , But when I try to login with normal AD user I am 
receiving the  error " kinit: Password incorrect while getting initial credentials"

ipa --version
VERSION: 4.5.4, API_VERSION: 2.228

KRB5_TRACE=/dev/stdout kinit -V [e-mail]
[28904] 1546967107.58765: Resolving unique ccache of type KEYRING
Using new cache: persistent:0:krb_ccache_nLG0yqq

[28904] 1546967107.58777: Response was not from master KDC
[28904] 1546967107.58778: Received error from KDC: -1765328359/Additional pre-authentication required
[28904] 1546967107.58781: Processing preauth types: 16, 15, 19, 2
[28904] 1546967107.58782: Selected etype info: etype aes256-cts, salt "APRIM.XXX nandha.kumaravel", params ""
[28904] 1546967107.58783: PKINIT client has no configured identity; giving up
[28904] 1546967107.58784: PKINIT client has no configured identity; giving up
[28904] 1546967107.58785: Preauth module pkinit (16) (real) returned: 22/Invalid argument
[28904] 1546967107.58786: PKINIT client has no configured identity; giving up
[28904] 1546967107.58787: Preauth module pkinit (14) (real) returned: 22/Invalid argument
Password for [e-mail]: 
[28904] 1546967125.768563: AS key obtained for encrypted timestamp: aes256-cts/675E
[28904] 1546967125.768565: Encrypted timestamp (for 1546967099.435765): plain 301AA011180F32303139303130383137303435395AA105020306A635, encrypted D03014021DFD2120B8EC876B6A6568CEC53DFFE6AB5003028B81A18173717C2C14259C5002A41900A974FF0E2F372EECB9E7F4836AE0DD43
[28904] 1546967125.768566: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
[28904] 1546967125.768567: Produced preauth for next request: 2
[
[28904] 1546967125.768577: Response was not from master KDC
[28904] 1546967125.768578: Received error from KDC: -1765328360/Preauthentication failed
[28904] 1546967125.768580: Preauth tryagain input types: 16, 14, 19, 2
[28904] 1546967125.768581: Retrying AS request with master KDC
[28904] 1546967125.768582: Getting initial credentials for [e-mail]
[28904] 1546967125.768584: Sending request (182 bytes) to aprim.xxx (master)
kinit: Password incorrect while getting initial credentials

[Robbie Harwood]

nandha kumar writes:
> I am running redhat 7.5 with freeipa 4.5 . I have established AD one
> way sync using password.  I am able to ssh the ipa client and ipa
> server with windows administrator account , But when I try to login
> with normal AD user I am receiving the error " kinit: Password
> incorrect while getting initial credentials"

Can you kinit as the administrator account?
> ipa --version
> VERSION: 4.5.4, API_VERSION: 2.228
>
> KRB5_TRACE=/dev/stdout kinit -V [e-mail]
> [28904] 1546967107.58765: Resolving unique ccache of type KEYRING
> Using new cache: persistent:0:krb_ccache_nLG0yqq
>
> [28904] 1546967107.58777: Response was not from master KDC
> [28904] 1546967107.58778: Received error from KDC: -1765328359/Additional pre-authentication required
> [28904] 1546967107.58781: Processing preauth types: 16, 15, 19, 2
> [28904] 1546967107.58782: Selected etype info: etype aes256-cts, salt "APRIM.XXX nandha.kumaravel", params ""
> [28904] 1546967107.58783: PKINIT client has no configured identity; giving up
> [28904] 1546967107.58784: PKINIT client has no configured identity; giving up
> [28904] 1546967107.58785: Preauth module pkinit (16) (real) returned: 22/Invalid argument
> [28904] 1546967107.58786: PKINIT client has no configured identity; giving up
> [28904] 1546967107.58787: Preauth module pkinit (14) (real) returned: 22/Invalid argument
> Password for [e-mail]: 
> [28904] 1546967125.768563: AS key obtained for encrypted timestamp: aes256-cts/675E
> [28904] 1546967125.768565: Encrypted timestamp (for 1546967099.435765): plain 301AA011180F32303139303130383137303435395AA105020306A635, encrypted D03014021DFD2120B8EC876B6A6568CEC53DFFE6AB5003028B81A18173717C2C14259C5002A41900A974FF0E2F372EECB9E7F4836AE0DD43
> [28904] 1546967125.768566: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
> [28904] 1546967125.768567: Produced preauth for next request: 2
> [
> [28904] 1546967125.768577: Response was not from master KDC
> [28904] 1546967125.768578: Received error from KDC: -1765328360/Preauthentication failed
> [28904] 1546967125.768580: Preauth tryagain input types: 16, 14, 19, 2
> [28904] 1546967125.768581: Retrying AS request with master KDC
> [28904] 1546967125.768582: Getting initial credentials for [e-mail]
> [28904] 1546967125.768584: Sending request (182 bytes) to aprim.xxx (master)
> kinit: Password incorrect while getting initial credentials

Can you verify that your password is actually correct?

Thanks,
--Robbie

[nandha kumar]

Hi Robbie,

Yes, I am able to kinit the administrator account

Yes. My password is correct and even I check for other 4 AD users, it gives the same error

Regards
Nandha

[Robbie Harwood]

nandha kumar via FreeIPA-users 
writes:
> Hi Robbie,
>
> Yes, I am able to kinit the administrator account
>
> Yes. My password is correct and even I check for other 4 AD users, it
> gives the same error

I don't know that there's much I can offer you here.  AD says the
password is wrong.  You could check DNS and that you're talking to the
right machines (all of which you've redacted here).

Thanks,
--Robbie

[Sumit Bose]

On Fri, Jan 11, 2019 at 04:38:15PM -0500, Robbie Harwood via FreeIPA-users wrote:
> nandha kumar via FreeIPA-users 
> writes:
> > Hi Robbie,
> >
> > Yes, I am able to kinit the administrator account
> >
> > Yes. My password is correct and even I check for other 4 AD users, it
> > gives the same error
>
> I don't know that there's much I can offer you here.  AD says the
> password is wrong.  You could check DNS and that you're talking to the
> right machines (all of which you've redacted here).

Besided that I wonder if there is a chance that due to some unexpected
codepage setting on the AD DC or locale on the client the salt or the
password are used in different encodings to derive the keys? I haven't
checked the RFC or MS-KILE to see if they say anything about encoding
but maybe someone knows from the top of his head?.

bye,
Sumit
> Thanks,
> --Robbie
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...