freeipa

#9350 Cannot authenticate using Kerberos after upgrade to 4.10.1
Closed: wontfix by abbra. Opened by amato.

Closed: wontfix
Reopen Issue

Hi all,
I have a FreeIPA installation with three servers on CentOS Stream 9. Recently, I upgraded one server from FreeIPA 4.10.0 to 4.10.1. After the upgrade, kinit <user> fails in the new server for all users, with the only exception of the admin user. The following happens:

1) In the command shell, I type kinit studente (or any other user but admin)
2) I enter the correct password
3) The result is kinit: Generic error (see e-text) while getting initial credentials

Kerberos authentication still works correctly on the servers which are still on 4.10.0. LDAP authentication works correctly everywhere.

If I check the /var/log/krb5kdc.log, I notice the following:

Mar 14 13:35:13 ipa1.labeconomia.unich.it krb5kdc2868: AS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17)}) 10.1.68.199: HANDLE_AUTHDATA: studente@LABECONOMIA.UNICH.IT for krbtgt/LABECONOMIA.UNICH.IT@LABECONOMIA.UNICH.IT, No such file or directory

So the problem seems this No such file or directory during the HANDLE_AUTHDATA phase, but I have no idea what file it is looking for.

Any idea about what's happening ?

Thanks,
--gianluca

Check that the users have SIDs associated with them.

and see what does KDC look for at this time in LDAP access logs. Logs might be buffered and be written ~30 seconds later.

Check that the users have SIDs associated with them.

Are not SIDs stuff related to Active Directory ? I don't have trusts with any Active Directory domain.
Edited by amato

SIDs are required in FreeIPA to prevent certain Kerberos-based attacks that originated in Active Directory but applicable to all environments which do not use PAC and do not check PAC structures. PAC requires SIDs and FreeIPA defaults to issuing SIDs.

See https://freeipa.readthedocs.io/en/latest/designs/adtrust/sidconfig.html. I am closing this issue because it is not a bug in FreeIPA but rather an operational problem which should be discussed on the mailing list instead.

Metadata Update from @abbra:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.