rdesktop failing with KCM kerberos cache

[Orion Poplawski]

I'm trying out sssd-kcm on Fedora 30 and it appears to break rdesktop.  I'm
now getting:

Failed to initialize NLA, do you have correct Kerberos TGT initialized ?
Core(debug): GSS error [0:13:0]: cssp_connect(), negotiation failed.
Core(debug):  - Unspecified GSS failure.  Minor code may provide more information
Failed to connect using NLA, trying with SSL
Failed to connect, CredSSP required by server (check if server has disabled
old TLS versions, if yes use -V option).

I bumped up the debug level on sssd_kcm and it seems to be fine - I see a
request for a credential and it sends a reply.

Any suggestions on what to check next?

[Sumit Bose]

On Thu, Apr 23, 2020 at 10:33:46AM -0600, Orion Poplawski wrote:
> I'm trying out sssd-kcm on Fedora 30 and it appears to break rdesktop.  I'm
> now getting:
>
> Failed to initialize NLA, do you have correct Kerberos TGT initialized ?
> Core(debug): GSS error [0:13:0]: cssp_connect(), negotiation failed.
> Core(debug):  - Unspecified GSS failure.  Minor code may provide more information
> Failed to connect using NLA, trying with SSL
> Failed to connect, CredSSP required by server (check if server has disabled
> old TLS versions, if yes use -V option).
>
> I bumped up the debug level on sssd_kcm and it seems to be fine - I see a
> request for a credential and it sends a reply.
>
> Any suggestions on what to check next?

Hi,

does 'klist' show your TGT?

Are you using multiple Kerberos realms, maybe you need to call 'kswitch'
to make the right TGT active?

Does 'KRB5_TRACE=/dev/stdout rdesktop ...' give some additional hints
what might be wrong?

HTH

bye,
Sumit
> -- 
> Orion Poplawski
> Manager of NWRA Technical Systems          720-772-5637
> NWRA, Boulder/CoRA Office             FAX: [phone]
> 3380 Mitchell Lane                       [e-mail]
> Boulder, CO 80301                 https://www.nwra.com/
> sssd-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail].o...