freeipa

#9962 race condition with wrong error code during deployment
Closed: fixed by rjeffman. Opened by abbra.

Closed: fixed
Reopen Issue

Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=2448253

2026-03-15T09:26:37Z DEBUG [try 1]: Forwarding 'schema' to json server 'https://ipa001.test.openqa.fedoraproject.org/ipa/json'
2026-03-15T09:26:37Z DEBUG New HTTP connection (ipa001.test.openqa.fedoraproject.org)
2026-03-15T09:26:37Z DEBUG received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=tOQOzYTYm3YG82Nz3I4P8ypWytW9NiOq42wvdZWgC8ixL6Bu9nlijvXXz%2biyEWdKmPFhQJ7tzMQIm05A%2fxBcbEfrhsv1Y83LdE5xkAsO4yxngpfiPqYrSLhpoU9mzrQRC0NGSA
gSu%2fV7it4aNhiy2r1Ry%2f0jYmGRABGYbjFlwkm6CkL7FErnlSFeEgcLBDtqQmXEb%2bf9kw5Al9y9lYhakuFL%2bmJrm3HL0M%2fS74NOF6xkIWrZDoqb3Y9Ht7enG0KvLcB7eyPWCQywyIKE5JkzLNX8YMs4%2bm7Tr%2b7fouYP49ChVTFSls8XMSEdS898x7G94vIYMzHvEQ8%2fQxyVMbCRWNzeRvP94
rrWMeeme1FIsJk%2fPre0Z2maBz8X6Vkpewrq5xFWAx9l9ZaRCWzLx6LcpO2x4QwHX6peuMtEP3YM0mQ%3d;path=/ipa;httponly;secure;']'
2026-03-15T09:26:37Z DEBUG storing cookie 'ipa_session=MagBearerToken=tOQOzYTYm3YG82Nz3I4P8ypWytW9NiOq42wvdZWgC8ixL6Bu9nlijvXXz%2biyEWdKmPFhQJ7tzMQIm05A%2fxBcbEfrhsv1Y83LdE5xkAsO4yxngpfiPqYrSLhpoU9mzrQRC0NGSAgSu%2fV7it4aNhiy2r1Ry%2
f0jYmGRABGYbjFlwkm6CkL7FErnlSFeEgcLBDtqQmXEb%2bf9kw5Al9y9lYhakuFL%2bmJrm3HL0M%2fS74NOF6xkIWrZDoqb3Y9Ht7enG0KvLcB7eyPWCQywyIKE5JkzLNX8YMs4%2bm7Tr%2b7fouYP49ChVTFSls8XMSEdS898x7G94vIYMzHvEQ8%2fQxyVMbCRWNzeRvP94rrWMeeme1FIsJk%2fPre0Z2
maBz8X6Vkpewrq5xFWAx9l9ZaRCWzLx6LcpO2x4QwHX6peuMtEP3YM0mQ%3d;' for principal host/ipa001.test.openqa.fedoraproject.org@TEST.OPENQA.FEDORAPROJECT.ORG

leads to the following in HTTP error_log:

[Sun Mar 15 05:26:37.273150 2026] [wsgi:error] [pid 9612:tid 10064] [remote 172.16.2.100:49256] ipa: DEBUG: WSGI wsgi_dispatch.__call__:
[Sun Mar 15 05:26:37.273273 2026] [wsgi:error] [pid 9612:tid 10064] [remote 172.16.2.100:49256] ipa: DEBUG: WSGI jsonserver.__call__:
[Sun Mar 15 05:26:37.273322 2026] [wsgi:error] [pid 9612:tid 10064] [remote 172.16.2.100:49256] ipa: DEBUG: KerberosWSGIExecutioner.__call__:

and in krb5kdc.log:

Mar 15 05:26:37 ipa001.test.openqa.fedoraproject.org krb5kdc[9333](Warning): MS-PAC not available. This makes FreeIPA vulnerable to privilege escalation exploit (CVE-2025-7493). Please generate SIDs to enable PAC support.
Mar 15 05:26:37 ipa001.test.openqa.fedoraproject.org krb5kdc[9333](info): TGS_REQ : handle_authdata (-1780008435)
Mar 15 05:26:37 ipa001.test.openqa.fedoraproject.org krb5kdc[9333](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-
cmac(26), camellia128-cts-cmac(25)}) 172.16.2.100: HANDLE_AUTHDATA: authtime 1773566796,  HTTP/ipa001.test.openqa.fedoraproject.org@TEST.OPENQA.FEDORAPROJECT.ORG for ldap/ipa001.test.openqa.fedoraproject.org@TEST.OPENQA.FEDORAPROJE
CT.ORG, Database has not been initialized
Mar 15 05:26:37 ipa001.test.openqa.fedoraproject.org krb5kdc[9333](info): ... CONSTRAINED-DELEGATION s4u-client=host/ipa001.test.openqa.fedoraproject.org@TEST.OPENQA.FEDORAPROJECT.ORG

this looks like one of conditions during initialization phase is broken after CVE-2025-7493 fixes.

Metadata Update from @abbra:
- Issue assigned to abbra

PR: https://github.com/freeipa/freeipa/pull/8257

Metadata Update from @abbra:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/8257

master:

  • 8ca4c96f95e60c00daf16c5a77713c1b9493aa06 ipa-kdb: fix S4U2Proxy failure when MS-PAC not yet initialized
  • d8a0a5e51b776d1f8d7bcf2e67b03c25b66c1029 ipa-kdb: fix PAC creation failure in DAL v9 when PAC generator not initialized
  • 070d9e3109976442246217cdd6ca0777f9c61157 ipa-kdb: warn when tickets are issued without PAC

ipa-4-12:

  • 63926f8cdf93b8735396b3be8076d96c3cb4f4e1 ipa-kdb: fix S4U2Proxy failure when MS-PAC not yet initialized
  • e024df7476c002204cd4e45893b094e8b672b638 ipa-kdb: fix PAC creation failure in DAL v9 when PAC generator not initialized
  • 8c91e98cb76a28e93903d4440cd1b07efb493876 ipa-kdb: warn when tickets are issued without PAC

ipa-4-13:

  • fdf089768322b77e4b21dfa845564de1187ddaa8 ipa-kdb: fix S4U2Proxy failure when MS-PAC not yet initialized
  • 541eb4e49748d832fcd0c11578200af5d8262ddb ipa-kdb: fix PAC creation failure in DAL v9 when PAC generator not initialized
  • 84a4ed22da400297b08dcc429cf63beea89e2aa4 ipa-kdb: warn when tickets are issued without PAC

Metadata Update from @rjeffman:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.