freeipa

#9398 ipakrbauthzdata = NONE causes minimal PAC to be present in service ticket
Closed: wontfix by abbra. Opened by carbenium.

Closed: wontfix
Reopen Issue

Request for enhancement

As an admin, I want to disable PAC inclusion in a service ticket to be configurable per service, so that samba doesn't choke when using that service ticket for authentication and being configured in standalone mode. See [1].

Issue

Even when setting the PAC type to NONE on the service in IPA, a (minimal) PAC seems to be included in the service ticket. The corresponding TGT which was requested by kinit without specifying --no-request-pac. This leads to samba, which is configured in standalone mode, to reject the ticket with NT_STATUS_BAD_TOKEN_TYPE [1].

I suppose this is caused by the krb5 1.20+ changes to PAC handling. I'm not sure if ipa-kdb can even suppress inclusion of the PAC with the new krb5 API. I'm not enough of an expert on this matter...

Using kinit --no-request-pac is not an option for the actual use-case, since the cifs connection is established via libsmbclient which requests the TGT itself. Unfortunately libsmbclient does not have an equivalent API for specifying --no-request-pac.

Steps to Reproduce

  1. Have samba configured in standalone mode (security = user)
  2. Have a cifs/... service configured in IPA with PAC type set to NONE
  3. Get TGT without passing --no-request-pac to kinit
  4. smbclient -k //...

Actual behavior

smbclient exits with NT_STATUS_BAD_TOKEN_TYPE

Expected behavior

smbclient successfully authenticates/connects to the samba server.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

freeipa-client-4.10.1-4.fc38.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-2.3.4-1.fc38.x86_64
package pki-ca is not installed
krb5-server-1.20.1-8.fc38.x86_64

Additional info:

I'll try to raise this issue on the samba side as well. There is actually a code path to explicitly request the inclusion of a PAC, but not an option to explicitly to exclude one [2].

[1] https://github.com/samba-team/samba/commit/2609e4297e04c93ca5bd1466617c4536faf5be32
[2] https://github.com/samba-team/samba/blob/a75378e354286d095d82f644d645768345cd00fb/source3/libads/kerberos.c#L180-L186

No, this cannot be done for security reasons, specifically for Samba. Samba requires PAC presence and relies on it. This is a decision made together during security fixes work done for a dollar sign CVE in 2020/2021. This is also a reason why MIT Kerberos pushed to include a minimal PAC. Active Directory requires PAC presence and will cut all non PAC clients from performing S4U extensions.

This, this ticket will be closed as wontfix.
Edited by abbra

Metadata Update from @abbra:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)

Thanks @abbra for the response!
Yeah, I already thought so, that these changes were done in response to those CVEs.

Let's see what the samba people say. Maybe a viable option would be to accept the minimal PACs in standalone mode.
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.