freeipa

#9891 Incorrect error type when user logs in multiple times with wrong password
Closed: fixed by sumenon. Opened by carlmart.

Closed: fixed
Reopen Issue

Issue

There is a small bug in the server code that processes the user-locked situation: while kinit reports "kinit: Client's credentials have been revoked ...", the code expects "kinit: Clients credentials have been revoked ..." -- notice missing apostrophe!

[Thu Dec 04 09:54:07.528263 2025] [wsgi:error] [pid 527039:tid 527271] [remote X.X.X.X.6:45714] ipa: INFO: 401 Unauthorized: kinit: Password incorrect while getting initial credentials
[Thu Dec 04 09:54:25.034576 2025] [wsgi:error] [pid 527041:tid 527274] [remote X.X.X.X:46600] ipa: INFO: 401 Unauthorized: kinit: Client's credentials have been revoked while getting initial credentials

Steps to Reproduce

  1. Go to freeipa WebUI login page
  2. Try to login with a given user/password. Add intentionally a wrong password multiple times.
  3. The same message will show, no matter how many times the wrong password is introduced.

Actual behavior

Server's error type is invalid-password.

Expected behavior

Server's error type should be user-locked.

Additional info:

Reproducer from freeipa-webui repository: https://github.com/freeipa/freeipa-webui/issues/1027

Metadata Update from @carlmart:
- Issue assigned to carlmart

master:

  • d75ac07291dcc701728baa3e6bd26977b9a5a662 Fix: Incorrect auth error message

ipa-4-12:

  • f7c078fde169601f9c2089e13bca7fc37d0a6a2b Fix: Incorrect auth error message

Metadata Update from @sumenon:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-13:

  • f39acce91176c043dd531646a2acd0b7678779e2 Fix: Incorrect auth error message
Metadata

bug

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.