(I also opened this bug at redhat bugzilla but afterwards it looks like this is not used anymore for freeipa? - so i open it here as well)

Issue

Using the "Change Password" in the Dropdown of the webui to change the password to one that includes a german umlaut (äüö) will make it impossible to login again on the webui. Login with the new password in ldap or via cli kinit still works.

krb5kdc says: " PREAUTH_FAILED: user@REALM for krbtgt/REALM@REALM, Incorrect password in encrypted challenge"

Resetting the Password via the admin and then change password via "Your password has expired. Please enter a new password." Prompt will lead to a working webui but you can not login at any other place (ldap, kinit). Also you can not change your password anymore "2100: ACIError"

Steps to Reproduce

1. Login to ipa web ui
2. Click on your username -> change password
3. Select a password with a german umlaut (like "chängeme2020")
4. Logout
5. Try to login again, "The password you entered is incorrect."

Actual behavior

No Login possible anymore on the webui, login in ldap is still possible.

Expected behavior

Login possible with new Password

Version/Release/Distribution

ipa-server-4.6.6-11.el7.centos.x86_64
ipa-client-4.6.6-11.el7.centos.x86_64
389-ds-base-1.3.10.1-5.el7.x86_64
pki-ca-10.5.17-6.el7.noarch
krb5-server-1.15.1-46.el7.x86_64

Additional info:

If you use the cli tool to change the password to one with a umlaut everything works except for the webui.