freeipa

#9402 OTP authentication failure on s390x
Closed: fixed by rcritten. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

The customer is using IPA on s390x and tries to enable OTP for a user, but OTP authentication fails with kinit: Preauthentication failed while getting initial credentials

Steps to Reproduce

  1. install ipa server
  2. create a user, assign a password: kinit admin; ipa user-add otpuser --first otp --last user --password
  3. the user resets his password: kinit otpuser
  4. enable otp for the user and assign a token: kinit admin; ipa user-mod otpuser --user-auth-type otp; ipa otptoken-add --owner otpuser
  5. try to obtain a kerberos ticket using otp: kdestroy -A; kinit -n; kinit -T KCM:0 otpuser, enter password and the 6-digits OTP

kinit fails with the error message kinit: Preauthentication failed while getting initial credentials

The issue happens on s390x but not on x86_64.

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2216872

Issue linked to bug 2216872

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/6898

master:

  • 7060e3a031fb4e4cdf85f616f1e1a3435d61e696 OTP: fix data type to avoid endianness issue

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2216872, https://bugzilla.redhat.com/show_bug.cgi?id=2218293 (was: https://bugzilla.redhat.com/show_bug.cgi?id=2216872)

ipa-4-10:

  • 631dd72369385b0793e5bc0e019c088b4f1e2bb3 OTP: fix data type to avoid endianness issue

ipa-4-9:

  • a7e167154b889f75463ccc9cd91a75c1afb22da9 OTP: fix data type to avoid endianness issue

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to Correct endianness issue that affected 2FA tokens use case for IPA server running on a mainframe (S390x architecture).
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.