freeipa

#9508 IPA 4.9.14 build fails against krb5 < 1.21
Closed: wontfix by slev. Opened by slev.

Closed: wontfix
Reopen Issue

With recent change of ipa-4-9 branch (https://pagure.io/freeipa/c/a847e2483b4c4832ee5129901da169f4eb0d1392)
build fails on systems having krb5 < 1.21.

ipa_kdb_mspac.c: In function 'ipadb_check_for_bronze_bit_attack':
ipa_kdb_mspac.c:3383:46: error: 'KRB5_PAC_FULL_CHECKSUM' undeclared (first use in this
 function); did you mean 'KRB5_PAC_SERVER_CHECKSUM'?
 3383 |     kerr = krb5_pac_get_buffer(context, pac, KRB5_PAC_FULL_CHECKSUM, &fullsign
);
      |                                              ^~~~~~~~~~~~~~~~~~~~~~
      |                                              KRB5_PAC_SERVER_CHECKSUM
ipa_kdb_mspac.c:3383:46: note: each undeclared identifier is reported only once for ea
ch function it appears in
make[3]: *** [Makefile:1042: ipa_kdb_mspac.lo] Error 1

KRB5_PAC_FULL_CHECKSUM was introduced in krb 1.21:
https://github.com/krb5/krb5/commit/4602a10dbe380d75d1ec00f7d34479ac9d503735

It needs a patch from krb5 in RHEL8 that is supposed to go out today. It was supposed to come out yesterday, sorry.

@jrische can you please share it?

It is in https://gitlab.com/jrisc/centos_rpms_krb5/-/commit/db46465e14452c9e429bffe218b6749327df052a

It is part of RHEL 8 krb5 build for some time: https://gitlab.com/redhat/centos-stream/rpms/krb5/-/blob/c8s/Add-PAC-full-checksums.patch?ref_type=heads

Better this one (sorry for much noise): https://gitlab.com/redhat/centos-stream/rpms/krb5/-/commit/7d215a54da9cdaade54a6e2a9f502a29095d0a25

There is additional patch in https://github.com/freeipa/freeipa/pull/7138 to allow you to build without these patches but then bronze-bit mitigation will not work for krb5 < 1.19.

@slev I hope this solves your issue?

I see, in other words, this is not supposed to be fixed on IPA side.

Thank you for the tips!

Metadata Update from @slev:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.