fedora-infrastructure

#8470 Can't renew FEDORAPROJECT.ORG krb ticket
Closed: Fixed by smooge. Opened by mbocek.

Closed: Fixed
Reopen Issue

When trying to renew my FEDORAPROJECT.ORG kerberos ticket (kinit -R) on Fedora 31 I'm getting an error kinit: KDC can't fulfill requested option while renewing credentials.

I was reading through the https://fedoraproject.org/wiki/Infrastructure/Kerberos but except the following I found nothing about the ticket renewals:
You can renew a existing ticket with kinit -R @FEDORAPROJECT.ORG

Any idea how to solve that?

This only seems to be happening with Fedora post 30 systems. I am not sure why yet. Can you do the following:

[smooge@fedora00 krb5.conf.d]$ klist -afe
Ticket cache: KCM:1000
Default principal: smooge@FEDORAPROJECT.ORG

Valid starting Expires Service principal
2019-12-17 16:55:54 2019-12-18 16:55:47 krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
renew until 2019-12-24 16:55:47, Flags: FRIA
Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
Addresses: (none)

Metadata Update from @smooge:
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue tagged with: authentication

 
$ klist -afe
Ticket cache: KCM:1000:4294965353
Default principal: mbocek@FEDORAPROJECT.ORG
Valid starting       Expires              Service principal
12/17/2019 17:00:40  12/18/2019 17:00:27  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
    Flags: FIA, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 
    Addresses: (none)
12/17/2019 17:19:06  12/18/2019 17:00:27  HTTP/id.fedoraproject.org@FEDORAPROJECT.ORG
    Flags: FAT, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 
    Addresses: (none)

OK working system which allows for updates:

Ticket cache: KEYRING:persistent:1000:1000
Default principal: smooge@FEDORAPROJECT.ORG
Valid starting       Expires              Service principal
2019-12-17 11:20:47  2019-12-18 11:20:40  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
    renew until 2019-12-24 11:20:03, Flags: FRIAT
    Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 
    Addresses: (none)

the difference is in the ticket cache with the F30 box using KCM and the EL7 box using Keyring. I remember some previous problems with KCM and renewing keys but I do not remember the specifics.

I found this article about KCM: https://fedoraproject.org/wiki/Changes/KerberosKCMCache
I went to the /etc/krb5.conf.d/kcm_default_ccache and commented out the lines:

[libdefaults]
    default_ccache_name = KCM:

I got a new ticket through regular kinit but I'm still getting the error when trying -R.

$ klist -afe
Ticket cache: KEYRING:persistent:1000:1000
Default principal: mbocek@FEDORAPROJECT.ORG
Valid starting       Expires              Service principal
12/17/2019 18:23:03  12/18/2019 18:23:01  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
    Flags: FIA, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 
    Addresses: (none)

Ah I see it finally.. it isn't the KCM.. it is something else. You are not requesting a renewable ticket.

Here is the log when you try to renew

Dec 17 17:28:13 ipa01.phx2.fedoraproject.org krb5kdc[4871](info): TGS_REQ (7 etypes {18 17 20 19 23 25 26}) 10.5.126.162: TICKET NOT RENEWABLE: authtime 0,  mbocek@FEDORAPROJECT.ORG for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG, KDC can't fulfill requested option

and looking at the flags you got:

    Flags: FIA, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sh

see there is no R in that flags list.. so the ticket is not renewable. Please do a 

kdestroy -a

and then a 

kinit -R <yourfasloginname>@FEDORAPROJECT.ORG

and let us see if the flags change.

Sorry wait on that.. that isn't the flag to get a renewable ticketg.

OK so I am actually typing this from the command line versus memory

kdestroy -A
[smooge@fedora00 etc]$ kinit -r 432000 smooge@FEDORAPROJECT.ORG
Password for smooge@FEDORAPROJECT.ORG: 
[smooge@fedora00 etc]$ klist -afe
Ticket cache: KCM:1000
Default principal: smooge@FEDORAPROJECT.ORG
Valid starting       Expires              Service principal
2019-12-17 18:18:36  2019-12-18 18:18:30  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
        renew until 2019-12-22 18:18:30, Flags: FRIA
        Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 
        Addresses: (none)
[smooge@fedora00 etc]$ kinit -R
[smooge@fedora00 etc]$ klist -afe
Ticket cache: KCM:1000
Default principal: smooge@FEDORAPROJECT.ORG
Valid starting       Expires              Service principal
2019-12-17 18:19:21  2019-12-18 18:19:15  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
        renew until 2019-12-22 18:18:30, Flags: FRIAT
        Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 
        Addresses: (none)

If I do it with the -r I get a ticket with the renew flag

@smooge, that's it, thanks!
Or to add the following to the /etc/krb5.conf:

[libdefaults]
    renew_lifetime = 7d

I'll add that to the FAQ at https://fedoraproject.org/wiki/Infrastructure/Kerberos.

OK I thought that was default.. in my EL7

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
# default_realm = EXAMPLE.COM
 default_ccache_name = KEYRING:persistent:%{uid}
 dns_canonicalize_hostname = false

I guess it got dropped between F28 and F31?

Metadata Update from @smooge:
- Issue assigned to smooge

Metadata Update from @smooge:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata

authentication

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.