freeipa

#8843 rpcserver fails to login as AD user when FAST armoring enabled
Opened by sorlov. Modified

Open
Close Issue

Issue

Commit b8b4677 added ability for rpcserver to fallback to non-armored kinit for trusted AD domain. This is working as expected in Fedora 32 and Fedora 33 but does not work in Fedora 34.

Steps to Reproduce

  1. Establish trust between IPA and AD
  2. Enable armoring on AD DC by executing first two steps in MS documentation, reboot
  3. On ipa server run curl -v -H referer:https://master.ipa.test/ipa -H Content-Type:application/x-www-form-urlencoded -H Accept:text/plain --cacert /etc/ipa/ca.crt --data 'user=Administrator@ad.test&password=Secret123' 'https://master.ipa.test/ipa/session/login_password'

Actual behavior

HTTP/1.1 401 Unauthorized

Expected behavior

HTTP/1.1 200 Success
...
Set-Cookie: ipa_session=MagBearerToken=hYr8TsOOqQ6480qDGmbiovWMq613bCC4m9PWXBfk%2fJHef0ctxu5ZQa35WdP%2f5zbhe4wFhlikZzCC0FU9mUkEUmM7vKMdu%2fZvzMG3zDebWgrlv%2ffDjzwxiQAavpaPR3L9MEY8fe0tIJjBwOAcoW5LVMSlc%2fXweEeNj64JP27yZmguKwidtgAJbOTCF6Rr9dTD7hbtkBNkeX%2bSpd%2ft6ubDMA%3d%3d;path=/ipa;httponly;secure;

Version/Release/Distribution

FreeIPA "master" branch

Additional info:

Based on automated test execution

  • Without FAST armoring login works on F33 and F34 and Fedora Rawhide
  • With FAST armoring login works on F33, fails on F34 and Fedora Rawhide

Test results:

This issue is blocking #8769

There seems to be no changes in kinit behavior between F33 and Rawhide.
I have executed following test cases (with cleanup of ./user_ccache and ./armor_ccache before each test):

  • TC1: kinit Administrator@ad.test -c ./user_ccache
  • TC2: kinit Administrator@ad.test -c ./user_ccache -T ./armor_ccache
  • TC3: kinit Administrator@ad.test -n -c ./armor_ccache && kinit Administrator@ad.test -c ./user_ccache -T ./armor_ccache

On F33, F34, Fedora Rawhide

  • without FAST armoring all cases succeed
  • with FAST armoring TC1 and TC3 succeed, TC2 fails with message ipa: ERROR: stderr: kinit: Error constructing AP-REQ armor: No credentials cache found (filename: ./armor_ccache) while getting initial credentials

Trace logs of krb5 can be found in test reports:

It looks as if there is no trust at all at the time of the request:

[17/May/2021:11:24:48.720228504 +0000] conn=112 op=193 SRCH base="dc=ipa,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=Administrator@ad.test)(krbPrincipalName:caseIgnoreIA5Match:=Administrator@ad.test)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..."
[17/May/2021:11:24:48.721462092 +0000] conn=112 op=193 RESULT err=0 tag=101 nentries=0 wtime=0.000212549 optime=0.001243688 etime=0.001452998
[17/May/2021:11:24:48.722014402 +0000] conn=112 op=194 SRCH base="dc=ipa,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/IPA.TEST@IPA.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/IPA.TEST@IPA.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..."
[17/May/2021:11:24:48.724468291 +0000] conn=112 op=194 RESULT err=0 tag=101 nentries=1 wtime=0.000387576 optime=0.002479351 etime=0.002864267
[17/May/2021:11:24:48.730597043 +0000] conn=112 op=195 SRCH base="dc=ipa,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/IPA.TEST@IPA.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/IPA.TEST@IPA.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..."
[17/May/2021:11:24:48.732401561 +0000] conn=112 op=196 SRCH base="dc=ipa,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/AD.TEST@IPA.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/AD.TEST@IPA.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..."
[17/May/2021:11:24:48.733705688 +0000] conn=112 op=196 RESULT err=0 tag=101 nentries=0 wtime=0.000199922 optime=0.001328667 etime=0.001526008
[17/May/2021:11:24:48.734121270 +0000] conn=112 op=197 SRCH base="dc=ipa,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/AD.TEST@IPA.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/AD.TEST@IPA.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..."
[17/May/2021:11:24:48.735547153 +0000] conn=112 op=197 RESULT err=0 tag=101 nentries=0 wtime=0.000298825 optime=0.001447398 etime=0.001743316
[17/May/2021:11:24:48.735980417 +0000] conn=112 op=198 SRCH base="dc=ipa,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/AD.TEST@IPA.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/AD.TEST@IPA.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..."
[17/May/2021:11:24:48.738042027 +0000] conn=112 op=198 RESULT err=0 tag=101 nentries=0 wtime=0.000311208 optime=0.002077248 etime=0.002385851
[17/May/2021:11:24:48.738336738 +0000] conn=112 op=199 SRCH base="dc=ipa,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/IPA.TEST@IPA.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/IPA.TEST@IPA.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..."
[17/May/2021:11:24:48.739742264 +0000] conn=112 op=199 RESULT err=0 tag=101 nentries=1 wtime=0.000194844 optime=0.001416893 etime=0.001609487
[17/May/2021:11:24:48.740082505 +0000] conn=112 op=200 SRCH base="dc=ipa,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/AD.TEST@IPA.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/AD.TEST@IPA.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..."
[17/May/2021:11:24:48.742000114 +0000] conn=112 op=200 RESULT err=0 tag=101 nentries=0 wtime=0.000208861 optime=0.001925565 etime=0.002132149
[17/May/2021:11:24:48.732536739 +0000] conn=112 op=195 RESULT err=0 tag=101 nentries=1 wtime=0.000302611 optime=0.001962914 etime=0.002262751
[17/May/2021:11:24:48.742225190 +0000] conn=112 op=201 SRCH base="dc=ipa,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/AD.TEST@IPA.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/AD.TEST@IPA.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..."
[17/May/2021:11:24:48.744162713 +0000] conn=112 op=201 RESULT err=0 tag=101 nentries=0 wtime=0.000125930 optime=0.001953213 etime=0.002076736
[17/May/2021:11:24:48.744484406 +0000] conn=112 op=202 SRCH base="dc=ipa,dc=test" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/AD.TEST@IPA.TEST)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/AD.TEST@IPA.TEST)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..."
[17/May/2021:11:24:48.749595827 +0000] conn=112 op=202 RESULT err=0 tag=101 nentries=0 wtime=0.000217017 optime=0.005133877 etime=0.005348130
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.