Re: [SSSD-users] Password Must Change using SSSD in Samba 4.1.10

[Rowland Penny]

On 08/01/15 05:09, Ashish Yadav wrote:
> Hi,
> What happens if you call
>
> kinit [e-mail] <mailto:[e-mail]>
>
>
> It asks for password and current password is working for getting 
> kerberos ticket and not asking me to reset the password.
> on the Linux command line. Are you asekd you for new password here? If
> not Samba might not return the right error code to indicate that the
> password is expired. 
>
>
> I posted this query in samba mailing list also but they told me that 
> if Windows 7 client is working fine then Samba is working fine.

No you weren't, you were told that you might have a better chance of 
getting it fixed on the sssd list because it worked from a windows 
client, so this meant it was *probably* a sssd problem, it may in the 
end turn out to be a samba problem, but sssd needs ruling out first and 
as I pointed out to you on the samba list, sssd is not part of samba.

Rowland
> In this case it would be nice if you can send the
> output of
>
> KRB5_TRACE=/dev/stdout  kinit [e-mail]
> <mailto:[e-mail]>
>
>
> Here is the output of the above command,
>
> # KRB5_TRACE=/dev/stdout  kinit test
> [2507] 1420693228.971649: Getting initial credentials for 
> [e-mail] 
> [2507] 1420693228.974468: Sending request (210 bytes) to 
> INTRA.EXAMPLE.COM http://INTRA.EXAMPLE.COM
> [2507] 1420693228.976230: Sending initial UDP request to dgram 
> 172.16.0.170:8880 http://172.16.0.170:8880
> [2507] 1420693228.981059: Received answer from dgram 172.16.0.170:8880 
> http://172.16.0.170:8880
> [2507] 1420693228.981167: Response was not from master KDC
> [2507] 1420693228.981252: Received error from KDC: 
> -1765328359/Additional pre-authentication required
> [2507] 1420693228.981413: Processing preauth types: 16, 15, 2, 138, 
> 136, 11, 19
> [2507] 1420693228.981477: Selected etype info: etype rc4-hmac, salt 
> "INTRA.EXAMPLE.COMtest", params ""
> [2507] 1420693228.981532: Selected etype info: etype rc4-hmac, salt 
> "INTRA.EXAMPLE.COMtest", params ""
> Password for [e-mail] :
> [2507] 1420693231.111979: AS key obtained for encrypted timestamp: 
> rc4-hmac/3CC1
> [2507] 1420693231.112235: Encrypted timestamp (for 1420693231.112064): 
> plain 301AA011180F32303135303130383035303033315AA105020301B5C0, 
> encrypted 
> F92A0E3BEF336E51C24C4CB9E8EB1ACE49ECA2BE32C9ABD207062898FD593268EEA31CF0185BE2B2B05F3A4A47328E9B1149AFA0
> [2507] 1420693231.112272: Preauth module encrypted_timestamp (2) 
> (flags=1) returned: 0/Success
> [2507] 1420693231.112292: Produced preauth for next request: 2
> [2507] 1420693231.112341: Sending request (286 bytes) to 
> INTRA.EXAMPLE.COM http://INTRA.EXAMPLE.COM
> [2507] 1420693231.112611: Sending initial UDP request to dgram 
> 172.16.0.170:8880 http://172.16.0.170:8880
> [2507] 1420693231.116296: Received answer from dgram 172.16.0.170:8880 
> http://172.16.0.170:8880
> [2507] 1420693231.116448: Response was not from master KDC
> [2507] 1420693231.116573: Processing preauth types: 3
> [2507] 1420693231.116586: Received salt "��" via padata type 3
> [2507] 1420693231.116597: Produced preauth for next request: (empty)
> [2507] 1420693231.116616: AS key determined by preauth: rc4-hmac/3CC1
> [2507] 1420693231.116694: Decrypted AS reply; session key is: 
> rc4-hmac/4D55
> [2507] 1420693231.116724: FAST negotiation: available
> [2507] 1420693231.116729: Initializing FILE:/tmp/krb5cc_0 with default 
> princ [e-mail] 
> [2507] 1420693231.117523: Removing [e-mail] 
>  -> 
> krbtgt/[e-mail] 
>  from FILE:/tmp/krb5cc_0
> [2507] 1420693231.117542: Storing [e-mail] 
>  -> 
> krbtgt/[e-mail] 
>  in FILE:/tmp/krb5cc_0
> [2507] 1420693231.117710: Storing config in FILE:/tmp/krb5cc_0 for 
> krbtgt/[e-mail] 
> : fast_avail: yes
> [2507] 1420693231.117903: Removing [e-mail] 
>  -> 
> krb5_ccache_conf_data/fast_avail/krbtgt/INTRA.EXAMPLE.COM 
> http://[e-mail]@X-CACHECONF: from 
> FILE:/tmp/krb5cc_0
> [2507] 1420693231.117920: Storing [e-mail] 
>  -> 
> krb5_ccache_conf_data/fast_avail/krbtgt/INTRA.EXAMPLE.COM 
> http://[e-mail]@X-CACHECONF: in 
> FILE:/tmp/krb5cc_0
>
> --Regards
> Ashishkumar S. Yadav
>
> sssd-users mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users