freeipa

#9382 IPA Web Login failure due to PKINIT after upgrade to openssl-libs-1:3.0.7-17.el9
Closed: invalid by abbra. Opened by mdobbins.

Closed: invalid
Reopen Issue

Issue

Unable to login to the IPA Web Interface after upgrading from openssl-libs-1:3.0.7-6.el9 to openssl-libs-1:3.0.7-17.el9 in FIPS mode. Web GUI responds with the error "Login failed due to an unknown reason", and the httpd error_log includes messages pointing to a kinit failure.

Manual kinit testing between a working instance and the failed instance show that the PKINIT preauth types are not being offered:

## WORKING:
# KRB5_TRACE=/dev/stdout kinit -n -c /tmp/test
[...]
[544886] 1684441428.169734: Response was from primary KDC
[544886] 1684441428.169735: Received error from KDC: -1765328359/Additional pre-authentication required
[544886] 1684441428.169738: Preauthenticating using KDC method data
[544886] 1684441428.169739: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
[544886] 1684441428.169740: Selected etype info: etype aes256-sha2, salt "AUTH.THEARK.CLOUDWELLKNOWNANONYMOUS", params ""
[544886] 1684441428.169741: Received cookie: MIT
[544886] 1684441428.169742: Preauth module pkinit (147) (info) returned: 0/Success
[544886] 1684441428.169743: PKINIT client received freshness token from KDC
[...]
## FAILED:
# KRB5_TRACE=/dev/stdout kinit -n -c /tmp/test
[12771] 1684441501.682711: Response was from primary KDC
[12771] 1684441501.682712: Received error from KDC: -1765328359/Additional pre-authentication required
[12771] 1684441501.682715: Preauthenticating using KDC method data
[12771] 1684441501.682716: Processing preauth types: PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2), PA-FX-COOKIE (133)
[12771] 1684441501.682717: Selected etype info: etype aes256-sha2, salt "AUTH.MY.DOMAIN.WELLKNOWNANONYMOUS", params ""
[12771] 1684441501.682718: Received cookie: MIT
Password for WELLKNOWN/ANONYMOUS@AUTH.MY.DOMAIN:

Steps to Reproduce

  1. Upgrade to openssl-libs-1:3.0.7-17.el9 in FIPS mode

Actual behavior

Unable to login to IPA Web GUI

Expected behavior

Able to login to Web GUI.

Version/Release/Distribution

$ rpm -q ipa-server ipa-client 389-ds-base pki-ca krb5-server

ipa-server-4.10.1-6.el9.x86_64
ipa-client-4.10.1-6.el9.x86_64
389-ds-base-2.2.4-3.el9.x86_64
package pki-ca is not installed
krb5-server-1.20.1-8.el9.x86_64

Additional info:

On both working and failed servers:

# ipa-pkinit-manage status
PKINIT is enabled
# cat /proc/sys/crypto/fips_enabled 
1

I will close this as this is an issue between PKINIT implementation in MIT Kerberos and OpenSSL FIPS provider in RHEL 9, not an issue in FreeIPA. This is tracked through corresponding bugzillas.

You can get a gist of the problems from our talk at SambaXP this year: https://sambaxp.org/fileadmin/user_upload/sambaxp2023-Slides/Bokovoy_sXP23_FIPS_140_3.pdf

There are actually several bugs as reflected in the talk. I will only point to two bugs, https://bugzilla.redhat.com/show_bug.cgi?id=2187722 and https://bugzilla.redhat.com/show_bug.cgi?id=2155607, as they are on openssl and krb5 sides. I am sorry if you cannot see some content in the bugs but they are the ones you need to track rather than here.

There is nothing to fix on FreeIPA side, once both openssl and krb5 fixed, things will start working again.

Metadata Update from @abbra:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.