Cause: When attempting to look up the addresses of servers configured in /etc/krb5.conf, the Kerberos client library did not recognize some of the result codes which could be returned by the resolver libraries.
Consequence: Instead of treating the inability to parse an IPv6 address as an IPv4 address as a non-fatal error, the client library would treat it as a fatal error, and fail to contact the server.
Fix: Patches were added to help ensure that these specific result codes could be interpreted properly.
Result: These errors no longer occur.
DescriptionGuenther Deschner
2014-04-03 14:29:03 UTC
Description of problem:
libkrb5 seems to have problems dealing with setups where a KDC has a ipv4 and a ipv6 addresses and when both addresses are put into a krb5.conf file.
When the KDC cannot be connected using the ipv6 address, kinit will only retry with the ipv4 address when the ipv6 address has the portnummer attached to it.
With this kinit will fail with "kinit: Invalid argument while getting initial credentials"
[realms]
AD.TEST.COM = {
kdc = [1234:52:0:2223::1:1]
kdc = 12.34.56.78
}
while the ipv4 address is tried with this configuration (and kinit succeeds).
[realms]
AD.TEST.COM = {
kdc = [1234:52:0:2223::1:1]:88
kdc = 12.34.56.78
}
Version-Release number of selected component (if applicable):
krb5-libs-1.11.3-49.el7
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://rhn.redhat.com/errata/RHSA-2015-0439.html
Description of problem: libkrb5 seems to have problems dealing with setups where a KDC has a ipv4 and a ipv6 addresses and when both addresses are put into a krb5.conf file. When the KDC cannot be connected using the ipv6 address, kinit will only retry with the ipv4 address when the ipv6 address has the portnummer attached to it. With this kinit will fail with "kinit: Invalid argument while getting initial credentials" [realms] AD.TEST.COM = { kdc = [1234:52:0:2223::1:1] kdc = 12.34.56.78 } while the ipv4 address is tried with this configuration (and kinit succeeds). [realms] AD.TEST.COM = { kdc = [1234:52:0:2223::1:1]:88 kdc = 12.34.56.78 } Version-Release number of selected component (if applicable): krb5-libs-1.11.3-49.el7