freeipa

#9485 handle better default user authentication types for services
Closed: fixed by frenaud. Opened by abbra.

Closed: fixed
Reopen Issue

From https://issues.redhat.com/browse/RHEL-4874

How reproducible:

[root@example ~]# ipa config-mod --user-auth-type=pkinit

ipa cannot be started

[root@example ~]# ipactl restart
Restarting Directory Service
Restarting krb5kdc Service
Failed to restart krb5kdc Service
Shutting down

Steps to Reproduce:

[root@example ~]# ipa config-mod --user-auth-type={otp,pkinit}
  Maximum username length: 32
  Maximum hostname length: 64
  Home directory base: /home
  Default shell: /bin/sh
  Default users group: ipausers
  Default e-mail domain: test.realm
  Search time limit: 2
  Search size limit: 100
  User search fields: uid,givenname,sn,telephonenumber,ou,title
  Group search fields: cn,description
  Enable migration mode: FALSE
  Certificate Subject base: O=TEST.REALM
  Password Expiration Notification (days): 4
  Password plugin features: AllowNThash, KDC:Disable Last Success
  SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-sx0:c0.c1023$sysadm_u:s0-s0:c0.c1023$unconfined_u:sx0-s0:c0.c1023
  Default SELinux user: unconfined_u:s0-s0:c0.c1023
  Default PAC types: MS-PAC, nfs:NONE
  Default user authentication types: otp, pkinit
  IPA masters: example.test.realm
  IPA master capable of PKINIT: example.test.realm
  IPA CA servers: example.test.realm
  IPA CA renewal master: example.test.realm
  IPA DNS servers: example.test.realm
[root@example ~]# ipactl restart
Restarting Directory Service
Restarting krb5kdc Service
Failed to restart krb5kdc Service
Shutting down
[root@example ~]# ipactl status
Directory Service: RUNNING
krb5kdc Service: STOPPED
kadmin Service: STOPPED
named Service: STOPPED
httpd Service: STOPPED
ipa-custodia Service: STOPPED
^CCancelled.
------

And following logs can be seen in the krb5kdc.log during this time.

------
May 02 22:40:41 example.test.realm krb5kdc[103666](Error): Cannot find master key record in database - while fetching master keys list for realm TEST.REALM
May 02 22:43:53 example.test.realm krb5kdc[103761](Error): Cannot find master key record in database - while fetching master keys list for realm TEST.REALM
May 02 22:44:14 example.test.realm krb5kdc[103837](Error): Cannot find master key record in database - while fetching master keys list for realm TEST.REALM

Additionally: the global configuration ipa config-mod --user-auth-type={password,otp} prevents host principals from authenticating with PKINIT. For auto-enrollment we rely on PKINIT with X.509 certs to install IPA clients. One of test setups had PKINIT globally disabled and then installation of new clients failed with error message "KDC policy rejects request".

PR: https://github.com/freeipa/freeipa/pull/7084

Metadata Update from @abbra:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/7084
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-4874

master:

  • 00f8ddbfd2795228b343e1c39c1944b44d482c18 ipa-kdb: add better detection of allowed user auth type
  • 69ae9febfb4462766b3bfe3e07e76550ece97b42 ipa-kdb: when applying ticket policy, do not deny PKINIT
  • 62c44c9e69aa2721990ca3628434713e1af6f59b ipa-kdb: clarify user auth table mapping use of _AUTH_PASSWORD
  • c3bc938650b19a51706d8ccd98cdf8deaa26dc28 ipatests: make sure PKINIT enrollment works with a strict policy

ipa-4-11:

  • c90ba9478b663bd5bcac9bb3af4272ee1406816b ipa-kdb: add better detection of allowed user auth type
  • 1fb026105ef397612a504722b2bcac29fbc69676 ipa-kdb: when applying ticket policy, do not deny PKINIT
  • fab08337dac0eb6322dc5ebe730b2541f4bb6111 ipa-kdb: clarify user auth table mapping use of _AUTH_PASSWORD
  • 02b17c8560a6aabb4be1109a3a794412f527c83c ipatests: make sure PKINIT enrollment works with a strict policy

ipa-4-10:

  • 94cd9a29c69c1430c90a62c8258962ef37fa1de3 ipa-kdb: add better detection of allowed user auth type
  • 4f998f7992bc5874705de9617f88f24e45ada92b ipa-kdb: when applying ticket policy, do not deny PKINIT
  • bb83a4f2d50812e933e981b07c19369a4f42af27 ipa-kdb: clarify user auth table mapping use of _AUTH_PASSWORD
  • 6e5bc8a73129571692884adfcf014d7b20451c24 ipatests: make sure PKINIT enrollment works with a strict policy

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-4874, https://issues.redhat.com/browse/RHEL-21813 (was: https://issues.redhat.com/browse/RHEL-4874)

ipa-4-9:

  • 1946a8b03f38750560983ad3049a4aa6863aea9a ipa-kdb: add better detection of allowed user auth type
  • d542a23f1eb0b0f9a98261f62e9fcb1d86c2b40b ipa-kdb: when applying ticket policy, do not deny PKINIT
  • 16fd9fedc18816a63403daa0f72511677abc587e ipa-kdb: clarify user auth table mapping use of _AUTH_PASSWORD
  • e53b3947c4f20f61d0532aa5a12273b4ba8a3bcc ipatests: make sure PKINIT enrollment works with a strict policy
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.