Description of problem:
IPA users receive "token manipulation error" when trying to change password
using `passwd`
Version-Release number of selected component (if applicable):
2.2
How reproducible:
Always
Steps to Reproduce:
1. Log in to an IPA client as an IPA user
2. Attempt to change password by running `passwd`
Actual results:
Token Manipulation Error
Expected results:
Successful password change
Additional info:
Not sure what the expectations for the IPA user are with regard to changing
their password. WebUI seems to be pretty consistent, but is not always
available.
-RHEL5.8 Client-
Logging in after password reset in WebUI:
---
[chris@miller ~]$ ssh chris@192.168.2.119
chris@192.168.2.119's password:
Warning: Your password will expire in less than one hour.
Password expired. Change your password now.
Last login: Tue Jul 10 12:12:33 2012 from 192.168.2.181
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for user chris.
Current Password:
New UNIX password:
Retype new UNIX password:
Warning: Your password will expire in less than one hour.
passwd: all authentication tokens updated successfully.
Connection to 192.168.2.119 closed.
---
Attempted password change after initial change:
---
[chris@r5client ~]$ passwd
Changing password for user chris.
Current Password:
New UNIX password:
Retype new UNIX password:
Password change failed. Server message: Password not changed.
passwd: Authentication token manipulation error
---
Levels:
---
[chris@r5client ~]$ cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.8 (Tikanga)
[chris@r5client ~]$ uname -r
2.6.18-308.8.2.el5
[chris@r5client ~]$ rpm -qa | grep -e ipa-client -e libipa
libipa_hbac-1.5.1-49.el5_8.1
ipa-client-2.1.3-2.el5_8
---
/var/log/secure output:
---
Jul 10 12:19:15 r5client passwd: pam_sss(passwd:chauthtok): system info:
[Generic error (see e-text)]
Jul 10 12:19:15 r5client passwd: pam_sss(passwd:chauthtok): User info message:
Password change failed. Server message: Password not changed.
Jul 10 12:19:15 r5client passwd: pam_sss(passwd:chauthtok): Password change
failed for user chris: 20 (Authentication token manipulation error)
---
-RHEL6.3 Client-
Logging in after password reset in WebUI:
---
[chris@miller ~]$ ssh chris@192.168.2.120
chris@192.168.2.120's password:
Password expired. Change your password now.
Last login: Tue Jul 10 12:20:55 2012 from 192.168.2.181
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for user chris.
Current Password:
New password:
Retype new password:
passwd: all authentication tokens updated successfully.
Connection to 192.168.2.120 closed.
---
Attempted password change after initial change:
---
[chris@r6client ~]$ passwd
Changing password for user chris.
Current Password:
New password:
Retype new password:
Password change failed. Server message: Password not changed.
passwd: Authentication token manipulation error
---
Levels:
---
[chris@r6client ~]$ cat /etc/redhat-release
Red Hat Enterprise Linux Server release 6.3 (Santiago)
[chris@r6client ~]$ uname -a
Linux r6client.example.com 2.6.32-279.el6.x86_64 #1 SMP Wed Jun 13 18:24:36 EDT
2012 x86_64 x86_64 x86_64 GNU/Linux
[chris@r6client ~]$ rpm -qa | grep -e ipa-client -e libipa
libipa_hbac-python-1.8.0-32.el6.x86_64
libipa_hbac-1.8.0-32.el6.x86_64
ipa-client-2.2.0-16.el6.x86_64
---
/var/log/secure output:
---
Jul 10 12:25:11 r6client passwd: pam_sss(passwd:chauthtok): system info:
[Generic error (see e-text)]
Jul 10 12:25:11 r6client passwd: pam_sss(passwd:chauthtok): User info message:
Password change failed. Server message: Password not changed.
Jul 10 12:25:11 r6client passwd: pam_sss(passwd:chauthtok): Password change
failed for user chris: 20 (Authentication token manipulation error)
Jul 10 12:25:11 r6client passwd: gkr-pam: couldn't update the 'login' keyring
password: no old password was entered
---
-IPA Master Levels-
---
[root@ipa ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 6.3 (Santiago)
[root@ipa ~]# uname -a
Linux ipa.example.com 2.6.32-279.el6.x86_64 #1 SMP Wed Jun 13 18:24:36 EDT 2012
x86_64 x86_64 x86_64 GNU/Linux
[root@ipa ~]# rpm -qa | grep -e ipa -e 389 | sort
389-ds-base-1.2.10.2-18.el6_3.x86_64
389-ds-base-libs-1.2.10.2-18.el6_3.x86_64
ipa-admintools-2.2.0-16.el6.x86_64
ipa-client-2.2.0-16.el6.x86_64
ipa-pki-ca-theme-9.0.3-7.el6.noarch
ipa-pki-common-theme-9.0.3-7.el6.noarch
ipa-python-2.2.0-16.el6.x86_64
ipa-server-2.2.0-16.el6.x86_64
ipa-server-selinux-2.2.0-16.el6.x86_64
libipa_hbac-1.8.0-32.el6.x86_64
libipa_hbac-python-1.8.0-32.el6.x86_64
---