SSSD / sssd

#433 Changing password with Kerberos succeeds, but still returns an error message
Closed: Fixed Opened by sgallagh.

Closed: Fixed
Reopen Issue

I have a configuration where I perform kerberos auth against a read-only replica KDC, but I perform password changes against a different KDC.

Changing password for user sgallagh.
Current Password: 
New password: 
Retype new password: 
passwd: Authentication token manipulation error

However, if I wait several minutes, I am able to kinit with the new password.

The reason for this failure is that we immediately attempt to kinit with the new password in the kerberos child after a password change, so that we have a new TGT provided by the new password. The problem right now is that we are attempting to kinit against the read-only replica, but the password change has not had time to propagate to it.

We need to ensure that in the case of a password change, we perform the kinit against the KDC on the krb5_kpasswd server rather than krb5_kdcip.

Fields changed

component: LDAP Provider => Kerberos Provider
owner: simo => sbose

Fixed by 1fafd0ab7e7c136ccc4fda54e6d2e0f947e28713

fixedin: => 1.1.1
resolution: => fixed
status: new => closed

Fields changed

rhbz: => 0

Metadata Update from @sgallagh:
- Issue assigned to sbose
- Issue set to the milestone: SSSD 1.1.1

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1475

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
Lowest
defect
Kerberos Provider
1.1.0
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.