fedora-infrastructure

#8401 kinit: Password incorrect while getting initial credentials
Closed: Fixed by andreir. Opened by andreir.

Closed: Fixed
Reopen Issue

Hello,

I have tried to follow kerberors configuration however I have no sucess.

my KRB5_TRACE=/dev/stdout looks like:

kinit andreir@FEDORAPROJECT.ORG
[174980] 1574374319.903922: Getting initial credentials for andreir@FEDORAPROJECT.ORG
[174980] 1574374319.903924: Sending unauthenticated request
[174980] 1574374319.903925: Sending request (213 bytes) to FEDORAPROJECT.ORG
[174980] 1574374319.903926: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
[174980] 1574374319.903927: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
[174980] 1574374319.903928: Resolving hostname id.fedoraproject.org
[174980] 1574374320.194082: TLS certificate name matched "id.fedoraproject.org"
[174980] 1574374320.194083: Sending HTTPS request to https 152.19.134.198:443
[174980] 1574374320.194084: Received answer (319 bytes) from https 152.19.134.198:443
[174980] 1574374320.194085: Terminating TCP connection to https 152.19.134.198:443
[174980] 1574374320.194086: Response was from master KDC
[174980] 1574374320.194087: Received error from KDC: -1765328359/Additional pre-authentication required
[174980] 1574374320.194090: Preauthenticating using KDC method data
[174980] 1574374320.194091: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-PK-AS-REQ_OLD (14), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENC-TIMESTAMP (2), PA-FX-COOKIE (133)
[174980] 1574374320.194092: Selected etype info: etype aes256-cts, salt "t2cIu,T@iyc)TC!/", params ""
[174980] 1574374320.194093: Received cookie: MIT
Password for andreir@FEDORAPROJECT.ORG: 
[174980] 1574374325.923333: AS key obtained for encrypted timestamp: aes256-cts/7020
[174980] 1574374325.923335: Encrypted timestamp (for 1574374326.262048): plain 301AA011180F32303139313132313232313230365AA105020303FFA0, encrypted A63A46B7E81B81266FB0DDE7B7488DA6EECFF14D363EC6178FBCC9E1A8CC1F1646F35C32CC0A20CFEE2D18C8A2BC208F05C54631958B4179
[174980] 1574374325.923336: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
[174980] 1574374325.923337: Produced preauth for next request: PA-FX-COOKIE (133), PA-ENC-TIMESTAMP (2)
[174980] 1574374325.923338: Sending request (308 bytes) to FEDORAPROJECT.ORG
[174980] 1574374325.923339: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
[174980] 1574374325.923340: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
[174980] 1574374325.923341: Resolving hostname id.fedoraproject.org
[174980] 1574374326.243765: TLS certificate name matched "id.fedoraproject.org"
[174980] 1574374326.243766: Sending HTTPS request to https 152.19.134.198:443
[174980] 1574374326.243767: Received answer (319 bytes) from https 152.19.134.198:443
[174980] 1574374326.243768: Terminating TCP connection to https 152.19.134.198:443
[174980] 1574374326.243769: Response was from master KDC
[174980] 1574374326.243770: Received error from KDC: -1765328360/Preauthentication failed
kinit: Password incorrect while getting initial credentials

I have checked that the password I use in FAS is the ok.

Thanks for the help!

When you last changed your password, did you use the 'forgot password' link? If so, please login and change the password via the edit user/change password (not the 'forgot' link).

Otherwise do you have any local mods to /etc/krb5.conf or /etc/krb5.conf.d/* ?

Do you have 'fedora-packager' installed? (It installs a fedoraproject.conf there)

Metadata Update from @kevin:
- Issue priority set to: Waiting on Reporter (was: Needs Review)

Hi @kevin ,

Thanks for the reply.

I have used user/change password.
I don't have any local mods.
Yes, I have fedora-packager installed.

I have reinstalled fedora-packager and changed my password once more. By doing this I can now get it to work.
Not sure what was the problem but thanks for the help!

klist -A
Ticket cache: KEYRING:persistent:1000:1000
Default principal: andreir@FEDORAPROJECT.ORG
Valid starting       Expires              Service principal
11/23/2019 07:14:57  11/24/2019 07:14:53  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
    renew until 11/30/2019 07:14:53

Metadata Update from @andreir:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
High
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.